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VETERANS AFFAIRS DATA PRIVACY BREACH: 
TWENTY-SIX MILLION PEOPLE DESERVE 
ANSWERS 


THURSDAY, MAY 25, 2006 

U.S. Senate, 

Committee on Veterans Affairs, 

AND Committee on Homeland Security and 
Governmental Affairs, 

Washington, DC. 

The Committees met, pursuant to notice, at 10:09 a.m., in room 
SD-342, Dirksen Senate Office Building, Hon. Larry E. Craig, 
Chairman of the Committee, presiding. 

Present: Senators Craig, Burr, Thune, Isakson, Collins, Chafee, 
Warner, Akaka, Murray, Obama, Salazar, Lieberman, Carper, Lau- 
tenberg, Pryor and Jeffords. 

OPENING STATEMENT OF HON. LARRY E. CRAIG, CHAIRMAN, 

COMMITTEE ON VETERANS’ AFFAIRS, U.S. SENATOR FROM 

IDAHO 

Chairman Craig. The Committee will be in order. 

I will ask the Secretary to sit down, take a deep breath and col- 
lect his thoughts. He has just come from a hearing in the House. 
Then we would appreciate photographers and media keeping it 
down as much as you can in the front. Thank you. 

We have an announced vote at or around 20 after, so we will at- 
tempt to get opening statements as much as we can prior. 

Good morning, ladies and gentlemen. On behalf of Chairman Col- 
lins, as well as the Ranking Members of the two Committees, Sen- 
ator Akaka of Veterans’ Affairs and Senator Joe Lieberman of 
Homeland Security and Governmental Affairs, I want to welcome 
all of you to this joint hearing this morning. 

First, I want to thank all of the Members of our two Committees 
for their willingness to participate jointly in this important hear- 
ing. I think the American public should understand that while this 
hearing is about the Department of Veterans Affairs and the com- 
promising of sensitive personal information about our veterans, the 
issue of data security is a concern all across Government. 

As I said on the Senate floor just 2 days ago, nearly every agency 
of the Federal Government maintains sensitive information on mil- 
lions of American citizens. Most of this data is not of the classified 
nature. Rather, it is information compiled simply to carry out the 
mission and programs of various agencies. 

( 1 ) 



2 


For example, the Federal student financial aid form requires that 
you provide your name, address. Social Security number, date of 
birth, information of your parents, and their addresses, along with 
many other things. Clearly, the release of that data would be as 
devastating to the privacy of millions of students and their families 
as VA’s breach was to millions of America’s veterans and their fam- 
ilies. 

Still, we are here today to talk about what the Secretary of Vet- 
erans Affairs announced to the Nation this past Monday. He told 
my Committee and other Members that an employee of the Depart- 
ment downloaded data of nearly 26 million veterans and then 
walked right out the front door with it. Subsequently, the data was 
stolen from this employee’s home. 

Mr. Secretary, I must tell you, that is pretty unbelievable. How 
is it that VA’s computer system permits one person to download 
the records of 26 million individuals and do so without any alert 
going off to anyone else who has the responsibility of the integrity 
of that system. 

Candidly to me, that is not even the most absurd part of the 
story as I now know it. What is even more important and mind- 
boggling is after he revealed the facts of the theft to his supervisor, 
it took 13 more days for anyone else to discover the lost data was 
on 26 million veterans and their families. Then it took 2 more days 
for the FBI to be notified. So somebody lost the names, the 
birthdates and the Social Security numbers of 26 million veterans 
and their families and the FBI knew nothing for nearly 2 weeks. 

Mr. Secretary, I read your statement yesterday in the press 
about the anger you felt at having discovered the lapse in security 
nearly 13 days after it happened. I am glad you are angry. You 
should be. You can only imagine how I and millions of veterans felt 
and now feel. 

I just came from doing C-SPAN. I did call-ins. America’s vet- 
erans across this country are frustrated. The word scared was 
used. The words are we at risk were used. And what do we do to 
protect ourselves? 

Mr. Secretary, I understand the need to spend some time with 
your staff assessing problems and reviewing options, but I find it 
increasingly frustrating that decisions are made without the knowl- 
edge and the input of a few of us. I think we can be trusted. I think 
you know that. 

Now, before I turn to Chairman Collins for her comments, I want 
to say a word about the employee who took the data home, as I 
now know it. While there is still an ongoing investigation as to the 
situation by the FBI, and I know that will limit some statements 
this morning, as best as I can tell from the information I have thus 
far, this person is a dedicated Federal employee who took work 
home with the hopes of improving VA’s operations. Yes, his actions 
were inexcusable. He knew better than to take information home, 
or I hope he did. I hope policy suggested he should not or insisted 
he should not. He knew better than to take information home. And 
yet, a terrible lapse in judgment, and now he is faced with the seri- 
ous consequences. But at least he told his supervisors and the law 
enforcement right away, which is more than we have been ac- 
corded. 
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I am not going to lose sight of the actions of everyone else in this 
situation. There were many lapses in judgment from many people. 
I hope this hearing today will shed some light on the shortcomings 
in VA’s data security programs and on what needs to happen to en- 
sure such a major breach never occurs again. 

Also, I think our discussion will heighten the awareness of many 
other agencies across our Government to the vigilance about data 
protection and information security. As I said earlier, students, 
farmers, and others who seek Government assistance deserve our 
best efforts to protect their critical, vital, private information. 

Most importantly, I hope today’s hearings will provide millions of 
veterans and their families the assurance they deserve to have, 
that you are doing everything possible, Mr. Secretary, and we will 
do the same. 

Thank you for being with us. 

Chairman Collins. 

OPENING STATEMENT OF HON. SUSAN M. COLLINS, CHAIR- 
MAN, HOMELAND SECURITY AND GOVERNMENTAL AFFAIRS 

COMMITTEE, U.S. SENATOR FROM MAINE 

Chairman COLLINS. Thank you, Mr. Chairman. 

First, let me begin by commending you for your leadership for 
seizing the initiative for suggesting this joint hearing. I and the 
Members of the Homeland Security Committee are very pleased to 
join you in this effort to quickly address a very serious matter that 
is of great concern to our Nation’s veterans, including some 141,000 
veterans in my home State of Maine. 

We are here today not merely to examine one incident, one mo- 
ment of carelessness — make that recklessness — ^by one Federal em- 
ployee. The specific incident compels us to confront the persistent 
and pervasive laxity with which the VA safeguards the personal in- 
formation of the veterans it serves. 

For 5 straight years, the VA’s Inspector General has criticized 
the Department for inadequate information security. On the an- 
nual Federal Computer Security Report Card issued by the House 
Government Reform Committee, the VA has received a grade of F 
for 4 of the last 5 years, including each of the last 2 years. 

This ongoing failure during a time when identity theft has been 
such a high-profile problem is simply appalling. The immediate re- 
sult of this failure is what appears to be the largest theft of Social 
Security numbers ever. The fact that the information also included 
veterans’ names and dates of birth means that the stolen data can 
easily be used to commit identity theft and financial fraud. 

The lingering result will be increased doubts among the Amer- 
ican people about the Federal Government’s commitment to safe- 
guarding their personal, sensitive information. 

When we think of cyber security, we focus on protecting vital in- 
formation systems against intrusion by criminals or terrorists. We 
now see that all the high-tech fixes in the world cannot protect 
these systems against one employee who disregards an established 
policy, and one agency that does not take sufficient measures to en- 
sure compliance with the policy. 

I am also troubled by the VA’s response. The burglary that led 
to this potentially massive intrusion occurred on May 3. Yet, as the 
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Chairman indicated, it apparently was not reported to the FBI for 
2 weeks. The American people, and most important our veterans, 
were not informed for nearly 3 weeks. 

Now, some delay prior to disclosure could well be reasonable, to 
allow law enforcement time to hunt for the stolen information or 
to put in place a system to respond to the many inquiries from our 
veterans. However, much of the delay in this case appears to be be- 
cause the VA did not promptly investigate the nature and the scope 
of the data breach. It simply appears that the VA did not handle 
this matter with the clear sense of urgency that it required. 

I am also concerned about the initiatives the VA has taken to ad- 
dress the immediate crisis. Is it sufficient simply to establish a toll- 
free number for veterans to call? We have already heard, in my of- 
fice and others, that veterans have called this number, but have 
been unable to learn much of anything. 

Is it sufficient to just accelerate a schedule of computer security 
training for VA employees? Or should more be done? We must en- 
sure that the remedies the VA puts in place, both short-term and 
long-term, are real, will make a difference and are not merely cos- 
metic. 

We must also view this incident as a wake-up call to the rest of 
the Federal Government. It is likely that the VA is not alone in the 
potential to suffer a data breach of this magnitude. Federal man- 
agers must recognize that they are stewards of a large amount of 
personal data on law abiding citizens, and they must guard this in- 
formation wisely or lose the people’s trust. 

It is tragically ironic that this profound betrayal of trust occurs 
just as the American people are preparing to honor our veterans. 
On this Memorial Day, the pride our veterans should feel in their 
service to our Nation will be dampened by anxiety and justifiable 
anger. 

These are the people who have served our Nation yesterday and 
who serve today. They are brave, patriotic, and devoted to duty. 
They deserve our gratitude and much more. They certainly deserve 
better than this. We owe them our best efforts so that the deep 
problems that this incident has exposed are fixed and so that the 
trust they should be able to have, not only in the VA but across 
our Government can be restored. 

Thank you, Mr. Chairman. 

Chairman Craig. Thank you, Madame Chairman. 

We do have a vote on and it started at 10:16. I suspect we can 
go. So Senator Akaka, if you would wish to go ahead with your 
opening statement, we will get a few more. I would ask that we 
keep these as limited as possible so we can get to the Secretary. 
But please proceed. 

STATEMENT OF HON. DANIEL K. AKAKA, RANKING MEMBER, 
U.S. SENATOR FROM HAWAII 

Senator Akaka. Thank you very much, Mr. Chairman, and 
Chairman Collins, for working together for calling this very impor- 
tant and timely joint hearing. 

As the Ranking Member on the Veterans’ Affairs Committee and 
a senior Member on the Homeland Security and Governmental Af- 
fairs Committee, I am privileged to sit on two committees that 
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have oversight on this issue. Having both Committees investigating 
this matter will allow us to address the specifics of the incident in- 
volving VA data and work to craft safeguards for the entire Gov- 
ernment. 

I would like to say, Mr. Chairman, that I want to associate my- 
self with the eloquent statement that you made. 

Let me be clear, the specific incident that brings us here today 
happens to involve VA and VA data. It could just as easily have 
involved other departments and agencies. It may be wise to have 
other departments and agencies examine their policies on classified 
and confidential data and the proper use and security for such 
data. 

Shortly after the news that the incident broke, I spoke with VA 
Inspector General George Opfer. He told me his office launched a 
full investigation into the matter which would examine all of the 
facts. I eagerly await his findings as the investigation will provide 
independent information for Congress to assess the situation. 

I also wrote to Secretary Nicholson with a number of questions 
and I look forward to his responses today. 

I have a longer statement, Mr. Chairman, but I will not read it 
so we have more time to hear from and question the witnesses. I 
ask that my full statement appear in the record as if read. Thank 
you very much, Mr. Chairman. 

[The prepared statement of Senator Akaka follows:] 

Prepared Statement of Hon. Daniel K. Akaka, Ranking Member, 

U.S. Senator from Hawaii 

Thank you Chairman Craig and Chairman Collins for working together to call 
this very important and timely joint hearing. As the Ranking Member on the Vet- 
erans’ Affairs Committee and a senior member on the Homeland Security and Gov- 
ernmental Affairs Committee, I am privileged to sit on the two committees that 
have oversight on this issue. Having both Committees investigating this matter will 
allow us to address the specifics of the incident involving VA data and work to craft 
safeguards for the entire government. 

Let me be clear — the specific incident that brings us here today happens to in- 
volve VA and VA data. It could just as easily have involved other departments and 
agencies. Shortly after the news of this incident broke, I spoke with VA Inspector 
General George Opfer. He told me his office launched a full investigation into the 
matter that will examine all the facts. I eagerly await his findings as the investiga- 
tion will provide independent information for Congress to assess this situation. I 
also wrote to Secretary Nicholson with a number of questions that need to be an- 
swered. I look forward to his response today. 

I am especially concerned with the manner in which VA handled this investiga- 
tion. Although the breach occurred more than 3 weeks ago. Congress and the public 
were only notified of the incident this week. 

Regardless of whether identity theft actually occurs as a result of this incident, 
anytime the government loses a database of personal information, privacy is com- 
promised. We must do all we can do to prevent this from ever happening again. The 
security mechanisms at VA are not working if a mid-level VA employee was able 
to walk out of the building with a massive amount of personal information. It seems 
to me that data of this magnitude and importance should be in the hands of very 
few VA employees and should be guarded with the utmost security. Thus far, VA 
has said the employee was not authorized to take the information home. 

I am troubled as to how an employee who is not authorized to take home the pri- 
vate information of more than twenty-six million veterans was still able to do just 
that. The VA failed to take several steps to safeguard this information. For example, 
VA could have scrambled Social Security numbers based upon an encryption for- 
mula, whereby access to files that translate scrambled Social Security numbers is 
only possible with special authorization. This procedure was not followed in this in- 
stance, and we need to know why. It is important to note how we came to learn 
about the loss of the data. The VA employee whose computer equipment was stolen 
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disclosed this to VA. If the employee had chosen not to report the theft immediately, 
VA and the public could possibly still be in the dark about the incident. 

As I said earlier, while today’s hearing is focusing on the information security 
practices at VA, I believe the data breach is indicative of broader information secu- 
rity and privacy problems throughout the government. I understand the problems 
that agencies face, as I have been working on Federal data collection and privacy 
for a number of years. At my request, the Government Accountability Office (GAO) 
conducted several investigations on Federal data mining activities and found that 
Federal agencies are not following all key privacy and information security prac- 
tices. Last week, I introduced legislation to strengthen the investigative authority 
and independence of the Chief Privacy Officer at the Department of Homeland Secu- 
rity. 

I believe we need to make sure that all agencies have a strong privacy official to 
ensure that what happened at VA will not happen again. Last year, the Office of 
Management and Budget directed each agency to designate a senior privacy official. 
However, issues remain as to whether these individuals are focused on matters 
other than privacy, which may cause a conflict of interest; the training received by 
and the expertise of these individuals; and the enforcement authority of the privacy 
officers in each agency. Having policies and safeguards in place will not work if 
agencies are not following the law. 

The incident at VA demonstrates the need to review the Privacy Act. I believe it 
is appropriate at this time. Chairman Collins, for your Committee to undertake this 
review as soon as possible. The applicability of the Act in this increasingly electronic 
age, combined with limited remedial action, necessitates that we take a closer look, 
and make sure that the personal information that the government collects is prop- 
erly maintained. 

It is unfortunate that, as the Nation prepares to celebrate those that paid the ulti- 
mate sacrifice in defense of our freedom, our government has breached the trust of 
its heroes. Our veterans deserve much better. I intend to work with all appropriate 
parties to provide real solutions to these glaring problems, not just in VA but across 
all government agencies and departments. Thank you. 

STATEMENT OF HON. JOSEPH I. LIEBERMAN, 

U.S SENATOR FROM CONNECTICUT 

Senator Lieberman. Thanks, Senator Akaka. We are going to 
continue going around and hope that Chairman Craig and Chair- 
man Collins come back in time. 

I want to thank them and Senator Akaka for holding this hear- 
ing as quickly as they have, so that we can get some answers about 
this enormous security breach, how it occurred in the first place 
and how we can quickly assist those veterans to whom we all owe 
so much and who have been put at risk by the loss of their con- 
fidential information. 

The security of Government computer systems and the vast data- 
bases contained within them is a subject we on the Homeland Se- 
curity and Governmental Affairs Committee have been working on 
for some time. 

As information technology continues to advance by leaps and 
bounds, we must take equivalent leaps and bounds to protect 
against the theft, misuse and abuse of information brought to- 
gether as never before by that technology. 

At various times in our lives we, the American people, are re- 
quired to provide the Government with all sorts of personal infor- 
mation. We do so out of necessity and sometimes out of choice. But 
we also, of course, provide it on the basis of trust. We, the Amer- 
ican people, will not feel comfortable sharing that information that 
the Federal Government needs if the Federal Government cannot 
guarantee that it is kept private and secure. 

This latest incident at the VA is just the most recent reminder 
that the Federal Government generally, I have concluded, is not 
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doing enough to guarantee that security. Three years ago, I asked 
the Government Accountability Office to assess and evaluate Fed- 
eral privacy protections. GAO looked into the privacy practices of 
25 Federal agencies and reported back that compliance was very 
uneven and that in nearly one-third of cases when agencies dis- 
closed personal information to non-Federal organizations, the agen- 
cies did not have procedures in place to ensure that the personal 
information disclosed was complete, accurate, relevant, and timely 
as required by the Privacy Act. 

Last year. Senator Collins and I took the Transportation Security 
Administration to task for violating the privacy of thousands of 
commercial airline passengers when it collected and stored per- 
sonal information about those passengers. Not only did TSA violate 
its own privacy policy, it also failed to meet the basic requirements 
of the Privacy Act, which is law. 

The VA security lapse is particularly troubling to all of us. Infu- 
riating, in fact, because of the population of veterans that may 
have been placed at risk. So we are here today to get answers to 
questions and they have really been framed by my colleagues who 
have spoken before. 

So, I will simply conclude by saying. Secretary Nicholson, I have 
great respect for you. I think you know that it is now up to you 
and your Department to restore the American public’s trust in the 
VA, which is a good and efficient Department, and in the ability 
of Government as a whole to carry out its duties without jeopard- 
izing personal and sensitive information the people of this country 
have and give to their Government. 

As part of that, I hope you will not hesitate to hold accountable 
anyone who was responsible for this failure to protect the confiden- 
tial information of millions of American veterans. 

Thank you very much. 

Senator Warner. 

STATEMENT OF HON. JOHN W. WARNER, 

U.S. SENATOR FROM VIRGINIA 

Senator Warner. Thank you, Mr. Chairman. 

I want to first say a few words about the Secreta^ of Veterans 
Affairs. I have known him for a very long time. In times like this, 
when we have literally a very serious problem at hand, it is fortu- 
nate Jim Nicholson has stepped up for continued public service. He 
has about as distinguished a career in the United States military 
as one can have in contemporary times. 

I thank you, my good friend, for calling me very promptly on the 
early morning when this news first became public and reassuring 
me, as I am sure you are going to reassure veterans all over Amer- 
ica, that you are going to have a total hand on the situation to hold 
accountable those who have perpetrated any wrongs or breach of 
law, and to reassure veterans that we are going to protect them to 
the extent we can. 

If I may say with some modesty, I am a veteran myself of World 
War II and Korea, and I have had a lifetime association, as you 
have Mr. Secretary, with the men and women of the Armed Forces 
who have served. And we must recognize, as my colleagues alluded, 
that technology has gone forward so rapidly. Ten years ago, if you 
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were trying to plan a theft like this, you would have to have a six- 
wheeler van to haul the information out. Now a simple disk can 
slide into the pocket. Consequently, we have to take measures 
which keep apace with technology to give the security that is re- 
quired in this situation. 

But I would like to once again say, as this hearing is com- 
mencing and as people are following it all across the United States, 
you will do a good job, Mr. Secretary. You will get to the bottom 
of this and solve it, because of your deep love, respect and affection 
for America’s veterans. 

Thank you. 

I think we should stand in recess until the return of the Chair. 
Do you wish to — good, thank you very much. 

STATEMENT OF HON. JAMES M. JEFFORDS, 

U.S. SENATOR VERMONT 

Senator Jeffords. Mr. Chairman, I appreciate your holding this 
hearing on such short notice to examine the frightful breach of se- 
curity at the VA that has led to the loss of significant data of mil- 
lions of veterans. I understand that the Government, and in par- 
ticular agencies such as the VA, who deal in direct health of indi- 
viduals need to have sensitive personal information. But the Gov- 
ernment therefore has a sacred obligation to make sure that this 
information is secure. This is an inexcusable breach of the basic 
compact of trust between the veteran and the VA. I am a veteran 
myself. 

The FBI must get to the bottom of how this happened and take 
immediate measure to ensure that it never happens again. We owe 
our veterans nothing less. 

I look forward to your testimony, Mr. Secretary, and hope you 
will give us reason to be reassured that the VA is taking imme- 
diate action to address this horrendous problem. 

Thank you, Mr. Chairman. 

The Committee will now stand in recess until the Chairman re- 
turns. 

[Recess.] 

Chairman Craig. The Committee will be back in order. 

Mr. Secretary, thank you for standing down for a few moments 
while we went to vote. 

Now let me turn to Senator Murray. 

STATEMENT OF HON. PATTY MURRAY, 

U.S. SENATOR FROM WASHINGTON 

Senator Murray. Let me thank Chairman Craig and Collins, as 
well as our Ranking Members Akaka and Lieberman, for calling 
this very important hearing today. 

Simply put, this is really a disaster. Our phones are ringing off 
the hook with veterans from all across the country who feel that 
their privacy has been violated and they are really losing faith in 
the VA. We have 85-year-old veterans who do not know the first 
thing about credit checks, and they are being told that their iden- 
tity has been compromised and they really do not know what to do. 
We need to find a way to provide assistance for all of our veterans 
and give them the peace of mind that they deserve. 
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Now, I know that some say that this is just an isolated incident, 
that this is an accident caused by one employee at the Department 
of Veterans Affairs, but Mr. Secretary, I have to tell you, from 
where I sit, this seems like just another demonstration of the agen- 
cy’s incompetence. 

As Chairman Collins said, the VA was told time and again by the 
IG that it had weaknesses in its information security systems. The 
VA was warned about the lack of protection for veterans’ sensitive 
health care and benefits information, and these warnings seem to 
have gone unnoticed by leadership within the VA. 

I hope we hear this morning from you, Mr. Secretary, about how 
this happened, why it took so long to tell our veterans that their 
information was compromised, what we are going to do to rectify 
this situation and what steps you are taking to ensure that it never 
happens again. 

Again, as we have discussed before, these Committees and this 
Congress have instilled in you the responsibility to fight and de- 
fend our veterans. I know that all of our veterans need you to be 
their greatest advocate. 

I am very disappointed by what has transpired and I hope that 
this agency really now rises to the occasion under your leadership 
and show all of us here and the millions of veterans that are at 
risk that you are here to protect them even from your own agency’s 
mistakes. 

Thank you, Mr. Chairman. 

Chairman Craig. Thank you. Senator. 

I note that statement was made in under 3 minutes. I appreciate 
that very much and would hope that our colleagues would attempt 
to adhere to that so that we can get to the Secretary. 

Let me turn to Senator Isakson. 

Johnny. 


STATEMENT OF HON. JOHNNY ISAKSON, 

U.S. SENATOR FROM GEORGIA 

Senator Isakson. Thank you, Mr. Chairman, and I will be brief. 

I thank you and Chairman Collins for calling this hearing. 

Mr. Secretary, I can empathically identify with the 760,000 vet- 
erans in Georgia who are probably on this list, because a year ago 
I was notified that my information had been lost or stolen by an 
American corporation and I know how I felt. I also know how they 
responded. And I hope we will and the Administration will respond 
swiftly to ensure the veterans are protected and they get the infor- 
mation they need. 

To that end, Mr. Chairman, I would like to ask unanimous con- 
sent to submit a letter for the record. 

Chairman Craig. Without objection. 

[The letter referred to follows:] 

Equifax Inc., 

Peachtree Street, Georgia, May 24, 2006. 

Hon. Johnny Isakson, 

U.S. Senate, 

Washington, DC. 

Dear Senator Isakson: At Equifax, we honor the enormity of our veteran’s con- 
tribution to the success and security of our great country, and are pleased to assist 
them in any way possible. Upon learning of the data breach at the Veterans Admin- 
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istration Office, Equifax immediately developed a special assistance page on our 
Equifax.com website. This page is designed to educate and assist our veterans on 
identity theft, and the ways in which they can safeguard their personal, informa- 
tion. This special assistance page includes the following: 

1. How to place an initial fraud alert on their credit file. This will alert creditors 
of possible fraudulent activity and request they contact the veteran prior to estab- 
lishing credit in their name. 

2. How to request a free copy of their credit file atannualcreditreport.com, or by 
phone or mail. 

3. A special offer for Equifax’s Credit Watch products available to veterans at a 
50 percent discount until June 30, 2006. Credit Watch, will monitor the veteran’s 
credit file and alert them to changes that could he early warning signs of identity 
theft. 

We look forward to continuing to work with the Veterans Administration Office 
to assist our veterans. 

Sincerely, 


Richard E. Smith, 

Chairman and Chief Executive Officer, Equifax, Inc. 


Senator Isakson. The Equifax Corporation out of Atlanta, on the 
day of the announcement, notified the VA and all veterans of a hot- 
line, affording them immediate access to a free credit report, and 
offered them a 50 percent discount on 1 year’s credit card service 
to monitor their credit. Mr. Richard Smith, who is the CEO of that 
company, was in Washington yesterday. I had the chance to talk 
to him and I thanked him personally for their voluntary effort. But 
I think it is important that the agency come together with a seam- 
less policy to protect all veterans. 

Lastly, Mr. Chairman, I want to commend you on your statement 
with regard to this being a wake-up call. As terrible as this loss 
of information is, just think if the Social Security Administration 
or the IRS and all their computer data information did not have 
a good security system. 

So I hope as we work to raise the level of interest in this issue 
and hold the VA accountable, we will make sure we are checking 
with every agency of the Government and making sure they are re- 
doubling their efforts to ensure this does not happen in any other 
agency as well. 

I yield back the balance of my time. 

Chairman Craig. Thank you. Senator. 

I am proceeding on the order with which Senators first came to 
the Committee, and I will turn to Senator Salazar. 

Excuse me, he is not here. 

In that case, it is Senator Lautenberg. 


STATEMENT OF HON. FRANK R. LAUTENBERG, 

U.S. SENATOR FROM NEW JERSEY 

Senator Lautenberg. Thanks, Mr. Chairman, and I will join the 
race to the 3-minute mark and see if I can rush through. 

Madame Chairman and our guest Chairman, thank you very 
much for arranging this joint hearing on such short notice. I appre- 
ciate the opportunity to learn about this alarming breach of secu- 
rity that has compromised the personal information of 26 million 
veterans and families. 

I served at an earlier time and the records regarding my service 
and those who served at my time were destroyed in a fire in St. 
Louis in the Veterans Administration facility. So it does not install 
a lot of confidence when we see what has happened now. 
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In the next few days, we are going home for Memorial Day, a day 
we want to honor our veterans and their service. But this week we 
learned that the Government has failed them, put them at risk, at 
significant risk. Our veterans deserve the hest in health care and 
other services. But what they got in this case is a security breach 
that puts them at risk for theft of their identity. 

In recent years, we have all learned that identity theft has seri- 
ous consequences for its victims. This incident, involving the VA, 
is the largest breach of Social Security numbers ever and it is ap- 
palling that something could happen. To make matters worse, the 
VA’s response to the crisis has not been satisfactory. As a matter 
of fact, it really destroys confidence in the functioning of the VA. 

They have a call center in New Jersey and veterans who call 
there do not think the VA call center is very helpful. These vet- 
erans will probably have to take some steps themselves to make 
sure that their credit information is not compromised and that they 
are not subjected to deep losses as a result. 

We should make it simple for them as much as we can. And that 
is why I am joining Senator John Kerry in supporting his bill to 
help veterans to stay informed about their credit status in the 
aftermath of this incident. 

Again, thank you very much, Mr. Chairman and Madame Chair- 
man. 

Chairman Craig. Senator, thank you very much. Now let me 
turn to Senator Thune. 

John. 


STATEMENT OF HON. JOHN THUNE, 

U.S. SENATOR FROM SOUTH DAKOTA 

Senator Thune. Thank you, Mr. Chairman and Madame Chair. 

I appreciate, as well, very much your holding this emergency 
hearing to deal with the theft of personal information for millions 
of our veterans, and I want to thank Secretary Nicholson for ap- 
pearing today. 

Mr. Chairman, I share your commitment to understand all the 
facts of this case before taking action, and I hope this hearing will 
generate light that we can use to do that. 

Having said that, this breach of information security at the VA 
is causing a lot of anxiety across the country among our veterans. 
And they are rightfully demanding that we act quickly on this 
issue. I have many veterans in my State of South Dakota who are 
justifiably concerned about identity theft, and they deserve to have 
peace of mind about their privacy. 

That is why we have to work quickly here on these committees 
to learn all the relevant facts and then take the appropriate action. 
And that, I think includes, in the short term, finding out the exact 
proportions of the problem and developing a proportionate remedy. 
Also, looking at the long term, at what we can do to make sure 
that this thing never happens again. 

As a number of Members of the Committee have already noted, 
the IG’s most recent strategic plan indicated that one of the stra- 
tegic goals was in the area of information management. It also 
noted many of the challenges the VA faces in the privacy of and 
the security of the information it manages. The strategic plan fur- 
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ther states that information systems security has heen identified as 
a material weakness as early as 1998 within the VA. 

And then there is this key passage on page 58, which I want to 
just read for you, 

The potential vulnerability of Federal information systems cannot be overesti- 
mated. Presently, VA systems are not protected from authorized access, risk of 
potential exposure, loss of sensitive data, fraudulent claims and disruption of 
critical activities remain. Security over VA IT resources needs to assure that 
only authorized users access VA resources and only authorized use is made of 
VA resources. Legal requirements such as the Privacy Act, the Federal Informa- 
tion Security Management Act of 2002, and the Health Information Portability 
and Accountability Act of 1996 impose detailed duties on the VA to protect sen- 
sitive medical and personal information it maintains on veterans, their families 
and its employees. 

Clearly, what the Inspector General was concerned about in terms 
of information security has now become a reality that we must deal 
with. I believe that this event occurred at least in part because 
many of the VA’s IT systems are compartmentalized within the 
VA’s three administrations: health, benefits and cemeteries; and 
there is not a uniform policy in terms of information security across 
the entire VA. 

That is why, Mr. Chairman, I introduced a bill, last fall, to im- 
prove the management of IT within the VA. My bill would provide 
for the VA’s Chief Information Officer to have authority over re- 
sources, budget and personnel related to the support function of in- 
formation technology. An identical bill has passed the House. I 
hope that this will give us an opportunity to pass it in the Senate. 

I appreciate again, Mr. Chairman, your holding this hearing. We 
are here to understand the entire context of this situation and then 
to work on both short-term and long-term solutions. We must do 
all that we can to ensure the information privacy of our veterans 
who have sacrificed so much for all of us. 

So thank you again and I look forward to the testimony. 

Chairman Craig. Senator, thank you. 

Senator Burr. 

STATEMENT OF HON. RICHARD M. BURR, 

U.S. SENATOR FROM NORTH CAROLINA 

Senator Burr. I thank both the Chairs. 

Mr. Secretary, Senator Isakson and I have something in common, 
in the fact that we both participated in this before from the stand- 
point of our records being lost. Mine happened to be a stolen laptop 
with my pertinent information from the accounting firm that does 
my taxes. I remember vividly getting the call and being walked 
through exactly what they were doing to make sure that they mini- 
mized what was a huge mistake. 

Fortunately, I have never had any repercussions from that over 
the several months that I have gone through. I am sure we can 
find a number of ways to tongue lash the system, and you and the 
Administration. 

Let me suggest to my colleagues, that is not what we are here 
to do. We are here to figure out — to work with you — to try to figure 
out how to remediate a problem that we do not know the scope of 
yet, to once again remind the Veterans Administration and every 
branch of Government that it is unacceptable to have the delay in 
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notification to the Congress, to the Federal law enforcement folks, 
that these are policies that we need to look at, that this cannot be 
something we make up on the go. 

I certainly commit myself to you and to the Chairs to work ag- 
gressively to find how we can adopt a policy that we all feel con- 
fident is structured in a way that minimizes the risk of this in the 
future. 

But more importantly, a policy that we can communicate to all 
concerned of exactly what we do if it ever does. I think the belief 
that we can assure with 100 percent accuracy that we can elimi- 
nate this is a dream. We cannot. That is why it is just as important 
that we understand that we need a policy in place that everybody 
understands that helps us to remediate this. 

Once again, I do want to say publicly to you that it is unaccept- 
able to have had a 60-day delay or a 15-day delay between the time 
that notification went out to the Administration, the Congress and 
the FBI. 

My hope is that through this hearing, it is the start of the road 
to a recovery from where we are. 

I thank the Chairs. 

Chairman Craig. Senator, thank you very much. 

Senator Obama. 

STATEMENT OF HON. BARACK OBAMA, 

U.S. SENATOR FROM ILLINOIS 

Senator Obama. Thank you very much to the Chairs for holding 
this hearing. I will try to be brief. 

This episode raises so many questions, but I think maybe the 
most poignant one was raised by Sonny McQueen, a DC area vet- 
eran. He said, “How else can the country let us down?” And I think 
that is a feeling that may be pervasive among a lot of veterans. 

I hope this hearing is the first step toward answering some of 
those questions. As has already been noted, why did it take 2 
weeks for the VA to notify the FBI? That was a 2-week head start 
for criminals to potentially wreck havoc. Why did the VA wait 
nearly 3 weeks to notify the veterans who were at risk? That is a 
policy issue. 

I have no doubt, Mr. Secretary, that you are as outraged as we 
are about this problem. But I am concerned about what is it struc- 
turally inside the VA that is preventing information from being 
dealt with properly? And what is preventing the VA from being 
forthcoming to veterans and the American people? 

We have a duty to make this right. The average identity theft 
victim spend 40 hours, apparently, to clean up his or her finances 
after something like this happens. So as a first step, I am hoping 
that the VA is going to be thinking about how it is going to provide 
credit monitoring and counseling services to the veterans who may 
be affected. This is a problem that may take a lot of time and 
money to fix, but we are going to need to make our veterans whole. 

Beyond that, I think it is important for us to understand that, 
although this may be a mistake of one employee, the reality is that 
this is a system that was destined to failure. Just a couple of quick 
facts. This is a system that scored an F in information security in 
4 of the past 5 years on a House Committee report card. This is 
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a system that in 2001 allowed VA employees in Atlanta to steal 
$11 million in benefits. The VA Inspector General, as has already 
been noted, has argued for years that the VA needed to improve 
its IT security. The VA Chief Information Officer abruptly resigned 
a month ago because the agency was not moving fast enough on 
its IT reorganization. 

So, we cannot pin this on one individual. This is a systemic 
breakdown. The system is so poorly designed that one employee 
could compromise the entire thing. That raises the question how 
could managers not realize that so many files were downloaded and 
brought offsite? And what steps is the VA going to take to secure 
veterans’ data used in other programs? 

I hope that through this hearing we can get to the bottom of this 
fiasco. I think we need to hold VA officials accountable. We also 
need to look forward and try to prevent identity theft across the 
private and public sector. It is estimated that 10 million consumers 
are affected annually. 

I understand that Senators Specter and Leahy are going to be 
looking at ways in that Committee to deal with issues of identity 
theft. I hope that all of us work on this. In the meantime, we are 
going to have to figure out how to clean up this mess. 

Thank you very much Mr. Chairman, Madame Chair. I look for- 
ward to the hearing. 

Chairman Craig. Thank you very much. Senator. 

Again on the order with which Senators came to the beginning 
of the hearing, let me turn to Senator Salazar and then to Senator 
Chafee. Thank you. 

Ken. 

STATEMENT OF KEN SALAZAR, 

U.S. SENATOR FROM COLORADO 

Senator Salazar. Thank you very much. Chairman Craig and 
Ranking Member Akaka and Chairman Susan Collins and Ranking 
Member Lieberman, for holding this hearing. 

Let me just say I think my colleagues have stated the concerns 
that we all share. And I know that Secretary Nicholson has also 
stated his concerns and how appalled he is about what has hap- 
pened here with the records of 26.5 million veterans. It is a huge 
issue that we need to address and we need to address effectively 
to make sure that we prevent this kind of thing from ever hap- 
pening again. 

Secondly, we need to make sure that we are taking every step 
in the world possible to safeguard the getting out of this informa- 
tion, from where ever this information happens to be today. 

But I also think it calls into question, even beyond the VA, what 
is happening with respect to all other Government agencies that 
have huge amount of information and the safeguarding of that in- 
formation in the new kind of technology. 

I was thinking about 26.5 million names and records related to 
26.5 million names. You know, 20 or 30 years ago you would never 
be able to put that into any kind of a file on a laptop. Well, that 
has all changed. And I think part of what we are seeing here is 
somehow the policies and oversight of information within our Gov- 
ernment has not kept pace with the new technological capacities 
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that have been developed with the computer capacities that we cur- 
rently have. 

So I look forward to working with you, Secretary Nicholson, to 
get us to a solution that will address the issue within the VA, but 
also I think for all of us in Government, we need to understand 
that this is an issue that also goes beyond the VA. 

Thank you and I have a more formal statement for the record, 
Mr. Chairman. 

Chairman Craig. Without objection, it will be a part of the 
record. 

[The prepared statement of Senator Salazar follows:] 

Prepared Statement of Hon. Ken Salazar, U.S. Senator from Colorado 

I want to start by thanking Chairman Craig, Chairman Collins, Senator Akaka, 
and Senator Lieberman for bringing together this critical hearing on such short no- 
tice. As we all know, one of the central questions in this troubling incident relates 
to whether or not the VA could have responded more quickly to the news that the 
personal information of 26.5 million veterans had been compromised. In light of 
those concerns, I believe it is imperative for Congress to act as quickly as possible 
to address this situation, and I hope today’s hearing will set an example. 

I also want to thank today’s panelists for agreeing to come before our committees 
today to discuss this important matter. I realize that many of you had to change 
your plans to be able to be here. But our veterans weren’t planning on having their 
information put at risk, either, and it’s important we do everything within our 
power to protect them during what must be a worrisome time. So, thank you. 

I am extremely troubled By what we learned earlier this week from the Depart- 
ment of Veterans’ Affairs. First and foremost, I share the concern of our Nation’s 
veterans about the potential for misuse of their names, birthdates, and Social Secu- 
rity numbers, and the consequences — hoth personal and financial — that could result. 

What is most troubling to me is the nature of the information that has been com- 
promised. This is not like losing your keys or your credit card, where you can 
change your locks or your account information. These are the fundamental keys to 
a person’s identity, and they could be used to open a bank account, take out a loan, 
obtain lines of credit, buy property — and the list goes on. The lives of millions of 
our Nation’s veterans could be turned upside down as a result of this security lapse. 

Second, this incident raises serious questions about the gaping holes in security 
that exist at VA, and about why more hasn’t been done about them in recent years. 
We have known that VA’s security safeguards are insufficient for years, and yet 
very little has been done to prevent the kind of theft we saw earlier this month. 
We need to know why, and we need to know what the VA plans to do now to ensure 
this kind of nightmare never happens again. 

Finally, as I have mentioned, we need to know more about how this event and 
VA’s response to this event unfolded, and why the department did not act more 
quickly to notify law enforcement. Congress, and most importantly, our veterans. 

I look forward to working with my colleagues to address this issue. I have written 
to VA urging the department to do everything it can to protect our veterans and 
make sure it doesn’t happen again. I am also a cosponsor of legislation introduced 
hy Senator Kerry that would require VA to provide 1 year of free credit monitoring 
to affected individuals, and one free credit report each year for 2 years thereafter. 

Our Nation owes a debt to our veterans that can never be fully repaid. It is deeply 
concerning to me that the very agency responsible for providing these veterans with 
the care and services they have earned failed to protect their most basic personal 
information. For that reason, I am hopeful that we can get to the bottom of some 
of these issues today. 

Thank you. 

Chairman Craig. Senator Chafee. 
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STATEMENT OF HON. LINCOLN D. CHAFEE, 

U.S. SENATOR FROM RHODE ISLAND 

Senator Chafee. Thank you, very much, Mr. Chairman. Wel- 
come, Secretary. 

I share my colleagues great, great concern about what occurred 
and want to work with you, after appropriate investigations and re- 
views are done, to any legislative fixes or funding concerns you 
might have to rectify the situation. 

I noticed in your opening statement, no specific requests at this 
point. But maybe after further reviews and investigations, there 
will be some concrete requests. I look forward to working with you 
on that, and also with Inspector General Opfer. 

Thank you, Mr. Secretary. Thank you, Mr. Chairman. 

Chairman Craig. Senator, thank you. 

Senator Pryor. 

STATEMENT OF HON. MARK PRYOR, 

U.S. SENATOR FROM ARKANSAS 

Senator Pryor. Thank you, Mr. Chairman. 

I think most of our colleagues here have covered my concerns 
with the VA and the bad news that we received in the last few 
days regarding the VA. But I do think that this is a reminder 
again, for Members of the Senate and Members of the House, that 
we need to act. And we need to spend time working through solu- 
tions for this so that the American public can protect itself. 

One thing we passed last year, I guess or in the last several 
months, in the Commerce Committee is a security freeze bill. Basi- 
cally what that would allow Americans to do is work through a 
credit bureau and freeze their financial information so that some- 
one could not tap into that, get credit cards, loans, et cetera, in 
their name without their permission. 

So, here you have a breach of 26-whatever million veterans and 
the security freeze would allow every person, if they chose to, to 
protect themselves in that way. So I think it is a good common- 
sense solution. It is something that has been through the Com- 
mittee. Hopefully, Senator Frist and Senator Reid will work out 
some time on the floor. I would love to have you all look at it when 
it gets to the floor. I think it is something that once you under- 
stand what it does and once you see it, you will realize the Amer- 
ican public would really like to have this option to protect them- 
selves against things like this. 

Thank you, Mr. Chairman. 

Chairman Craig. Thank you. 

Mr. Secretary, again welcome to the Committee. Please tell us 
you are mad as hell. 

STATEMENT OF HON. R. JAMES NICHOLSON, SECRETARY, 

DEPARTMENT OF VETERANS AFFAIRS; ACCOMPANIED BY 

TIM S. McCLAIN, GENERAL COUNSEL, DEPARTMENT OF VET- 
ERANS AFFAIRS 

Secretary Nicholson. You can count on that, Mr. Chairman. 

Chairman Craig. Thank you. 

Secretary NICHOLSON. Mr. Chairman, Members of the Com- 
mittee, I appreciate having this opportunity to appear before you 
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to talk about this devastating occurrence that has happened in my 
agency and come to my attention only recently and was announced 
to the veterans and to the public and to the Congress this past 
Monday. 

I am the person ultimately responsible to our veterans. And 
therefore, I am the person responsible for this situation. This re- 
sponsibility rests on me. 

A VA employee, a data analyst, took home electronic data files 
from the VA. He was not authorized to do so. His house was bur- 
glarized and the data were stolen. This happened on May 3rd. 

If this were not bad enough, I was not notified about this event 
until May 16th. So I can tell you, as a 34-year veteran myself, I 
am mad as hell. I am outraged by all of this. I am outraged that 
this employee would do this so recklessly. And I am outraged that 
I was not notified of it sooner. 

But I still must carry on and lead the efforts needed to get to 
the bottom of this and take the corrective actions to see that this 
does not happen again. My compass for this is the veterans. I feel 
so badly for them and what they are going through potentially and 
the anxiety that this is causing and what it could cause. 

As has been said, these stolen data contained the information, in- 
cluding the names and date of birth, for 26.5 million veterans and 
some spouses. In addition, that information, plus Social Security 
numbers, were available for some 19.6 million of those veterans, of 
those 26.5 million. Also included possibly were some numerical dis- 
ability ratings and the diagnostic codes that identify their dis- 
ability. 

It is good to note that the data did not include any VA electronic 
health records. Neither did it contain explicit financial information, 
although knowing a disability rating code could lead one to com- 
pute at least what that compensation payment was. 

On May 3rd this employee’s home was broken into and local law 
enforcement was notified immediately. They report that they think 
this was a routine breaking and entering. That is, it was not a tar- 
geted burglary. It was a random burglary. 

The employee has been placed on administrative leave pending 
the outcome of this investigation, with which he is cooperating. 

As I have said, I am a veteran and this is just incredulous. I am 
so damned mad at the loss of our veterans data and the fact that 
one person could put all of us at risk, one person in violation of VA 
policies. 

I am just as mad and disappointed that I was not made aware 
of this before I was. 

So, I am upset about the timing of our response. I will not tol- 
erate inaction and poor judgment when it comes to protecting our 
veterans. 

Appropriate law enforcement agencies, including local police, the 
FBI, and the Inspector General, have now launched full-scale in- 
vestigations. Authorities believe it is unlikely the perpetrators tar- 
geted the items stolen because of any knowledge of the data con- 
tents. It is possible that the thieves remain unaware of the infor- 
mation they possess and how to make use of it. 

Because of that, we attempted to not be too specific about the de- 
scription of the equipment stolen, the location from which it came 



18 


and other information in general. We do not want to provide infor- 
mation to the thieves that might he more helpful to the nature of 
what they have and we still hope this was a common theft and that 
no use will be made in this VA data. 

From the moment I was informed, the VA began taking all pos- 
sible steps to protect and inform our veterans. However, there were 
those in the law-enforcement community who wanted me to wait 
longer before announcing this theft, so as to pursue leads and to 
keep the burglars in the dark. I chose to inform our veterans nev- 
ertheless, but limiting the details of where and when initially so as 
not to tip our hand to the robbers. 

Whether it is one veteran or the numbers we are talking about 
here today, the VA needed to act in a manner that maintained a 
balance between protecting them and informing the perpetrators. I 
chose to get the information out at that point to the veterans, in 
spite of the continuing investigations. 

Another very disturbing aspect of this is that although it hap- 
pened on May 3rd, and this employee informed his boss of this fact 
on that day, as I said, I was not made aware until May 16th. 
Equally disturbing is that Federal law enforcement head and inves- 
tigating agencies were not informed immediately either. Local 
were, but not Federal. It was not until May 10th that the VA IG 
became aware of it. 

I cannot explain these lapses in judgment on the part of my peo- 
ple. Most of them are really great, hard-working people. It makes 
me so angry and disappointed. And after the IG finishes his inves- 
tigation as to exactly what happened, I plan to take decisive ac- 
tions. I have to. 

The VA now has also begun a relentless examination of our poli- 
cies and procedures to find out how we can prevent something like 
this from happening again. We will stay focused on the problems 
until we get them fixed. I have formed a special task force to exam- 
ine comprehensively all of our information programs and policies to 
bring about a ringing change in the way we do business. 

I have begun recruiting to see if I can find the right individual 
to come into our agency to be the personal information security 
czar, if you will, who has nothing else in his or her portfolio, to 
focus on that and report directly to me. 

As has been stated here, ever since 1999 the VA has gotten low 
marks from the IG on its information and cyber security programs. 
Last year the GAO flunked the VA on its cyber security system. 
This has got to change. 

This situation is exacerbated by the fact that the Assistant Sec- 
retary for IT, who had been at the VA for about 21/2 years, has just 
recently resigned. He had come to the VA from the private sector, 
from Dell. He has returned to the private sector. He did a very 
good job and I will say that I think we are off to a real solid start 
in the IT transformation that we are doing. 

And this is beyond the scope here, but VA has gotten decentral- 
ized down literally to almost clinics, of which there are 900. We are 
pulling this back into a centralized format in this major IT trans- 
formation that we are in. And that is launched. But as is painfully 
evident, we have a great deal to do. 
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I was also pleased that just yesterday, President Bush an- 
nounced his intention to nominate a brilliant, recently retired Navy 
Admiral that we have recruited to come into our agency to head up 
our Office of Policy and Planning, which is the office in which this 
transgression occurred. We hope to have him on board very soon. 

Additionally, we are taking direct and immediate action to ad- 
dress and alleviate veterans’ concerns and to regain their con- 
fidence. Those actions include that we have directed all VA employ- 
ees to complete the VA Cyber Security Awareness Training Course 
and a separate General Employee Privacy Awareness course and to 
do so by June 30th of this year. 

I have also directed that a memo be issued requiring all VA em- 
ployees to sign annually an employee statement of awareness, in- 
cluding their awareness of the Privacy Act, their awareness as to 
unauthorized disclosing or using directly or indirectly information 
obtained as a result of their employment in the VA, which is of a 
confidential nature or represents a matter of trust, or other infor- 
mation so obtained of such a character that its disclosure or use 
would be contrary to the best interest of the veterans and of their 
awareness of the loss or damage or unauthorized use of Govern- 
ment property or its carelessness or negligence in its use therein. 

Additionally, the Department will immediately be conducting an 
inventory and review of all current positions requiring access to VA 
data. 

This, I think, is a very important point because, as it turns out, 
we do not know anything about these people. The person who took 
this data home, the last that I can tell, had a background check, 
just a National Agency and Inquiries Check, 32 years ago. Yet, we 
entrust this kind of data to people. 

And I might say, by the way, and this is not said in anyway as 
some kind of an excuse, but this man or others, they do not have 
to carry this data out. They can send it out. If they have Internet 
Explorer on their computer, they can send it to their account and 
then get on their own computer and receive it. 

I also would tell you, and please, this is not said in any way to 
excuse or mitigate what happened thus, but I am holding in my 
hand a hard drive. This is unrelated to the equipment in this inci- 
dent. But that data that we are talking about for these 26.5 million 
veterans is 5 gigabytes. This little thing right here, that slips so 
easily into my vest pocket, holds 60 gigabytes. We could have 12 
times the data that is the subject of this pain that we are in on 
this thing, this little hard drive. 

This, as you probably all know, which most people that use these 
use them as a key chain, and call them most commonly a thumb 
drive, this would hold about three-quarters of the data that we are 
talking about, this size. Most people that use these in my agency 
have them hanging around their neck with their ID card and walk 
in and out. 

There are lots of things that we are going to have to do as an 
agency, and I think as a Government. But the key, it seems like 
to me, is going to be the law. And by the way, this person did not 
violate any law, because there is no law. We have internal policies 
against what he did. But he did not violate the law, as near as I 
can tell. 
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And we are going to have to — for people that have access to this 
kind of data, we are going to have to know something about them. 
If they were in the military and they were privy to confidential in- 
formation, they would have a background investigation. And a lot 
of that, you read in the paper what we are giving them access to. 

So, I am proposing that we are going to do an updated National 
Agency Check on those. And for those that have special access, re- 
quest a minimum background investigation. 

I have directed the Office of Information and Technology to pub- 
lish by June 30th a VA directive and revisions to security guide- 
lines for single user remote access developed by the Office of Cyber 
and Information Security. This document will set the standards for 
access, for use and information security, including physical security 
and reporting. 

We are working with Members of the Congress, the VSOs and 
the news media and other agencies to ensure that other veterans 
and their families are aware of this situation and the steps that 
they may take to protect themselves for the misuse of their per- 
sonal information. 

We are coordinating with other agencies to send individual notifi- 
cations to all 19.6 million individuals whose Social Security num- 
bers were stolen. That is, we are going to send a letter to each of 
these people, instructing them and asking them to be both vigilant 
in order to detect any signs of possible identity theft and how to 
protect themselves. 

As you know, in the meantime, they can go to the Internet portal 
we have established, which is www.FirstGov.gov , for information on 
this matter. And this is a Federal site that is capable of handling 
a great amount of traffic. 

Additionally, we have set up a manned call center that veterans 
can use to get information and learn more about consumer identity 
protections. You can reach that with a toll-free number of 1-800- 
333-4636. It operates 14 hours a day and will as long as it is need- 
ed. It can handle 20,000 calls per hour. By the end of the day yes- 
terday, concerned veterans had made a total of 105,753 calls to this 
number. 

I do want to acknowledge the significant efforts of numerous 
Government agencies in assisting the VA to prepare for the an- 
nouncement last Monday. Agencies at all levels pitched in to en- 
sure that our veterans had information on actions that they could 
take with respect to their credit. Hundreds of people worked 
around the clock, that is they worked through the night, in helping 
to set up these call centers and get the messages composed and out 
and did a yeoman’s job. I want to thank each of them and these 
agencies for their efforts on behalf of our veterans. 

The three national credit card bureaus have established special 
procedures to handle inquiries and requests for fraud alerts from 
veterans. Experian and TransUnion have placed a front-end mes- 
sage on their existing toll-free fraud lines, bypassing the usual 
phone tree with instructions for placing a fraud alert. Equifax has 
set up a new toll-free number for veterans to place fraud alerts. 

The new procedures became operational on Tuesday. The bu- 
reaus report a spike in phone calls, 171 percent of normal, and in 
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requests for free credit report through the annual free credit report 
weh site. 

The Federal Trade Commission also experienced high call vol- 
umes about the incident earlier this week. 

On Monday, the Office of Comptroller of the Currency notified its 
examiners of this theft. On Tuesday, the Office of Comptroller post- 
ed an advisory on an Internet network available to its banks and 
instructed the examiners to direct their banks to the advisory. It 
explains what happened and asks the banks to exercise extra dili- 
gence in processing veterans’ payments. The advisory also reminds 
banks of their legal obligations to verify the identities of persons 
seeking to open new accounts and to safeguard customer informa- 
tion against unauthorized access or use and attaches a summary 
of relevant regulations. 

I briefed the Attorney General and the Chairman of the Federal 
Trade Commission, the co-chairs of the President’s Identity Theft 
Task Force, shortly after I became aware of this occurrence. They 
have been very cooperative. Task Force members have already 
taken actions to protect the affected workers, including — excuse 
me, to protect the affected veterans, including working with the 
credit bureaus to help ensure that veterans receive free credit re- 
ports that they are entitled to. 

Additionally, the Task Force met on Monday to coordinate the 
comprehensive Federal response to recommend further ways to pro- 
tect affected veterans and increase safeguards to prevent the recur- 
rence of such incidents. On Monday following the announcement of 
this incident, I also issued a memorandum to all VA employees. 
The purpose was to remind them of the public trust that we hold 
and to set forth the requirements that all employees complete their 
annual general privacy training and cyber security for this current 
year by the end of next month. 

Following that, all will be required to sign a statement of com- 
mitment and understanding which will acknowledge the con- 
sequences for noncompliance. 

Information security is challenging business and ultimately it de- 
pends on the integrity and the ethics of the workforce. As has been 
said here, as technology has advanced, it has become possible to 
store vast quantities of data on devices no larger than one’s thumb- 
nail. 

All of us carry a cell phone, a BlackBerry or a personal digital 
assistant, and each of these contains vast quantities of data. Some- 
one intent on taking this data and using it inappropriately has 
many opportunities to do that. 

It is also the fact that great numbers of people in this agency and 
in this Government telecommute. For example, yesterday I was 
talking to an employee of ours who is an information technology 
specialist. And he told me of needing some medical records. He 
asked for them to be burned onto a CD, and that was done and it 
was delivered to him very promptly and neatly. 

And so he wrote the person an e-mail back saying thank you for 
this prompt, efficient work. He said, “By the way, where do you 
work here in the central office? Maybe we could have a cup of cof- 
fee some time.” And the person responded by saying, “I do not work 
in the central office. I work in South Dakota.” 
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It illustrates how far-flung and distended some of this has got- 
ten. We need obviously to know who they are, know what kind of 
people they are out there with this data, and absolutely get better 
control over it. 

And I promise you that we are going to do everything in our 
power to structure a regime at the VA that makes clear what is 
proper in the use of data by our employees and train our employees 
in those policies and enforce them. 

We have already begun discussions regarding the immediate 
automatic encryption of all sensitive information. We will also work 
with the President’s Task Force on Identity Theft. I am a member 
of the Task Force. And it will help to structure policies that will 
be put in place throughout the Government to help ensure that sit- 
uations such as this do not occur at other agencies. 

In summary, Mr. Chairman and Members of the Committees, I 
want to say that the VA’s mission is to serve and honor our Na- 
tion’s veterans, and we take it very seriously. I am also proud to 
say that most of the 235,000 people that work there are terrific and 
take it seriously and are dedicated to our veterans. So, I am so sad- 
dened by what has happened here, in this case by one person, and 
the anxiety and concern that this is causing to our veterans and 
our families because they have enough to deal with. 

We honor the service of our veterans and we consider it a privi- 
lege to work for them at our agency. I want you and them to know 
that we are and are going to work hard to keep this most awful 
thing from happening again. 

Thank you. 

[The prepared statement of R. James Nicholson follows:] 

Prepared Statement of Hon. R. James Nicholson, Secretary, 
Department of Veterans Affairs 

Mr. Chairman and Members of the Committee: 

Thank you for the opportunity to appear before you today to explain a devastating 
situation. 

A VA employee, a data analyst, took home electronic data files from VA. He was 
not authorized to do so. 

These data contained identifying information including names and dates of birth 
for up to 26.5 million veterans and some of their spouses. In addition, that informa- 
tion, plus social security numbers, was available for some 19.6 million of those vet- 
erans. Also possibly included were some numerical disability ratings and the diag- 
nostic codes which identify the disabilities being compensated. 

It is important to note that the data did not include any of VA’s electronic health 
records. Neither did it contain explicit financial information, although knowing of 
a disability rating could enable one to compute what that implied in terms of com- 
pensation payments. 

On May 3, the employee’s home was broken into in what appears to local law en- 
forcement to have been a routine breaking and entering, and the VA data were sto- 
len. The employee has been placed on administrative leave pending the outcome of 
an investigation with which I understand he is cooperating. 

I am outraged at the loss of this veterans’ data and the fact an employee would 
put it at risk by taking it home in violation of VA policies. However, the employee 
promptly reported the theft to the local police and to the Department of Veterans 
Affairs. But it was not until May 16th that I was notified. I am gravely concerned 
about the timing of the Department’s response once the burglary became known. I 
will not tolerate inaction and poor judgment when it comes to protecting our vet- 
erans. 

Appropriate law enforcement agencies, including local police, the FBI and the VA 
Inspector General’s office, have launched full-scale investigations into this matter. 
Authorities believe it is unlikely the perpetrators targeted the items stolen because 
of any knowledge of the data contents. It is possible that the thieves remain un- 
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aware of the information they possess or of how to make use of it. Because of that, 
we have attempted to describe the equipment stolen, the location from which it was 
stolen and other information in very general terms. We do not want to provide infor- 
mation to the thieves that might be informative as to the nature of what they have 
stolen. We still hope that this was a common theft, and that no use will be made 
of the VA data. 

From the moment I was informed, VA began taking all possible steps to protect 
and inform our veterans. 

In our post-disclosure assessment, we have seen the gaps between what we said 
and the way we are seen. 

VA has begun a top to bottom examination of our business, policies, and proce- 
dures to find out how we can prevent something like this from happening again. 
We will stay focused on the problems until they are fixed. In addition, we will take 
direct and immediate action to address and alleviate veterans’ concerns and to re- 
gain their confidence. 

I have taken the following actions so far: 

• I have directed all VA employees to complete the annual “VA Cyber Security 
Awareness Training Course” and complete the separate “General Employee Privacy 
Awareness Course” by June 30, 2006. 

This includes: 

• The Privacy Act; 

• Unauthorized disclosing or using, directly or indirectly, information obtained as 
a result of employment in VA, which is of a confidential nature or which represents 
a matter of trust, or other information so obtained of such a character that its dis- 
closure or use would be contrary to the best interests of the VA or veterans being 
served by it; and, 

• Loss of, damage to, or unauthorized use of Government property, through care- 
lessness or negligence, or through maliciousness or intent. 

• I have also directed that all VA employees sign annually an Employee State- 
ment of Commitment and Understanding which will also acknowledge consequences 
for non compliance. 

In addition the Department will immediately begin to conduct an inventory and 
review of all current positions requiring access to sensitive VA data. The inventory 
will determine whether positions in fact require such access. We will then require 
all employees who need access to sensitive VA data to do their jobs to undergo an 
updated National Agency Check and Inquiries (NACI) and/or a Minimum Back- 
ground Investigation (MBI) depending on the level of access required and the re- 
sponsibilities associated with their position. 

And I have directed the Office of Information & Technology to publish, as a VA 
Directive, the revisions to the Security Guidelines for Single-User Remote Access de- 
veloped by the Office of Cyber and Information Security. I have asked that this be 
done by June 30, 2006. This document will set the standards for access, use, and 
information security, including physical security, incident reporting and responsibil- 
ities. 

VA is working with Members of Congress, the news media, veterans’ service orga- 
nizations, and numerous government agencies to help ensure that those veterans 
and their families are aware of the situation and of the steps they may take to pro- 
tect themselves from misuse of personal information. 

VA is coordinating with other agencies to send individual notifications to those 
individuals whose social security numbers were stolen, instructing them to be vigi- 
lant in order to detect any signs of possible identity theft and telling them how to 
protect themselves. In the meantime, veterans can also go to www.firstgov.gov for 
more information in this matter. This is a Federal Government Web site capable 
of handling large amounts of web traffic. 

Additionally, working with other government agencies, VA has set up a manned 
call center that veterans may use to get information about this situation and learn 
more about consumer-identity protections. That toll free number is 1-800-FED INFO 
(333-4636). The call center is operating from 8 am to 9 pm (EDT), Monday-Saturday 
as long as it is needed. The call center is able to handle up to 20,000 calls per hour 
(260,000 calls per day). Through the end of the day on Tuesday, concerned veterans 
had made a total of 105,753 calls to this number. 

I want to acknowledge the significant efforts of numerous government agencies in 
assisting VA to prepare for our announcement on May 22nd. Agencies at all levels 
of the Federal Government pitched in to ensure that our veterans had information 
on actions they could take to protect their credit. Hundreds of people worked around 
the clock writing materials to inform the veterans and setting up call centers and 
a website to ensure maximum dissemination of the information. I want to personally 
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thank each of those agencies and those individuals for their selfless efforts on behalf 
of our veterans. 

The three nationwide credit bureaus have established special procedures to han- 
dle inquiries and requests for fraud alerts from veterans. 

Experian and TransUnion have placed a front-end message on their existing toll- 
free fraud lines, bypassing the usual phone tree, with instructions for placing a 
fraud alert. Equifax has set up a new toll-free number for veterans to place fraud 
alerts. The new Equifax number is 1-877-576-5734. The new procedures became 
operational on Tuesday. The bureaus report a spike in phone calls (171 percent of 
normal) and in requests for free credit reports through the annual free credit report 
web site (annualcreditreport.com). The Federal Trade Commission also experienced 
high call volumes about the incident earlier this week. 

On Monday, the Office of Comptroller of the Currency notified its examiners of 
the theft. On Tuesday, OCC posted an advisory on an internal network available 
to its banks and instructed the examiners to direct their banks to the advisory. It 
explains what happened and asks the banks to exercise extra diligence in processing 
veterans’ payments. The advisory also reminds the banks of their legal obligations 
to verify the identities of persons seeking to open new accounts and to safeguard 
customer information against unauthorized access or use. It also includes a sum- 
mary of relevant laws and regulations. 

I briefed the Attorney General and the Chairman of the Federal Trade Commis- 
sion, co-chairs of the President’s Identity Theft Task Force, shortly after I became 
aware of this occurrence. 

Task Force members have already taken actions to protect the affected veterans, 
including working with the credit bureaus to help ensure that veterans receive the 
free credit report they are entitled to under the law. Additionally, the Task Force 
met on Monday to coordinate the comprehensive Federal response, recommend fur- 
ther ways to protect affected veterans, and increase safeguards to prevent the recur- 
rence of such incidents. 

On Monday, following the announcement of this incident, I also issued a memo- 
randum to all VA employees. The purpose was to remind them of the public trust 
we hold and to set forth the requirement that all employees complete their annual 
General Privacy Training and VA Cyber Security Awareness training for the current 
year by June 30. 

As technology has advanced, it has become possible to store vast quantities of 
data on devices no larger than one’s thumb. All of us carry a cell phone, a Black- 
Berry or a Personal Digital Assistant, and each of these contains vast quantities of 
data. Someone intent on taking such data and using it inappropriately would have 
many opportunities to do that. 

I can promise you that we will do everything in our power to make clear what 
is appropriate and inappropriate use of data by our employees. We will train em- 
ployees in those policies, and we will enforce them. We have already begun discus- 
sions regarding the immediate automatic encryption of all sensitive information. 

We will also work with the President’s Task Force on Identity Theft, of which I 
am a member, to help structure policies that will be put in place throughout the 
government to ensure that situations such as this do not occur at other agencies. 

VA’s mission to serve and honor our Nation’s veterans is one we take very seri- 
ously and the 235,000 VA employees are deeply saddened by any concern or anxiety 
this incident may cause to those veterans and their families. We honor the service 
our veterans have given their country and we are working diligently to protect them 
from any harm as a result of this incident. 


Response to Written Questions Submitted by Hon. Daniel K. Akaka 
TO Hon. R. James Nicholson 

On February 11, 2005, Office of Management and Budget (0MB) Deputy Director 
for Management Clay Johnson issued a memorandum directing each agency to des- 
ignate a senior official who would have agency-wide responsibility for privacy issues 
relative to information management. 

Question la. Who is VA’s senior privacy official? When was this position estab- 
lished at VA? 

Question lb. What training does VA’s designated privacy official receive? Is this 
training then passed on to all agency personnel? Please provide a copy of the train- 
ing documents VA provides its employees. 

Question Ic. I understand that 0MB meets with all the agencies’ senior privacy 
officials and their teams to review the status of the agencies’ privacy programs. Has 
0MB met with VA’s privacy official, and if so, do you know what OMB found with 
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respect to VA’s privacy program? If problems were found, how has VA addressed 
the problems identified? Are the problems identified by 0MB still remain at VA? 

Question Id. If the privacy official has a concern about an agency practice or pro- 
gram, what enforcement authority does he or she have? To whom does the senior 
privacy official report? 

Question le. What is the working relationship between the VA privacy official and 
Privacy and Civil Liberties Oversight Board? 

Question 2. Recently VA announced the naming of Special Advisor for Information 
Security. What will be the role and responsibilities of the Special Advisor? How will 
the responsibilities and duties of this official differ from those assigned to the senior 
privacy official? How will this individual work with the senior official designated for 
privacy issues and the Chief Information Officer at VA? 

Question 3. The Privacy Act does not require the VA to provide notice of a data 
breach. What Federal or state law required the VA to notify the public of the data 
breach? 

Response. VA did not respond to the questions. 


Written Questions Submitted by Hon. Norm Coleman to 
Hon. R. James Nicholson 

The senior VA employee who took the sensitive information home was working 
on a project which involved improving telephone interactions between the Depart- 
ment and Veterans. While the employee was authorized to have access to this data 
in connection with the project, the employee was not authorized to take the data 
home to work on it. Although the employee received the required training on pro- 
tecting the privacy and security of this kind of information and knew it was against 
VA policy, the employee still chose to take it home. 

Question la. How confident are you that other VA employees do not similarly 
have confidential data in their homes? Can we be 100 percent confident? 

Question lb. Would you say it is routine for employees who have access to sen- 
sitive information to remove it from the VA to work on at home? Is it easy to remove 
this information? 

Question Ic. Is there any way for you to know how many employees remove sen- 
sitive information from the VA? 

Question Id. Are employees aware of the penalties for removing sensitive informa- 
tion from the VA? Can you tell us what the penalties are? 

Mr. Secretary, you found out about the security breech on May 16th, yet veterans 
were not informed until May 22nd. On May 19th, the Inspector General and your 
staff decided not to go public because the hotline being established by the FTC to 
handle veterans’ calls had not been fully set up. However, when this type of security 
breech has happened in the private sector, consumers have been alerted very quick- 
ly, often in less than 24 hours. 

Question 2a. Do you still think it was the right decision to wait to inform veterans 
that their information may have been compromised? 

Question 2b. What would have been the downside to making an announcement 
so veterans could begin reviewing their financial information while putting informa- 
tion on your website and saying a call center would be up and running in a few 
days? 

Question 2c. Are you getting any feedback on whether the call centers are helpful? 
Is the VA partnering with the Veterans Service Organizations to provide informa- 
tion to their members about what happened and what they can do to protect this 
information? 

On May 3rd, the same day as the discovery of the burglary and theft, the VA em- 
ployee called and reported to a supervisor and VA security officials the loss of sen- 
sitive privacy data. However, Mr. Secretary, you did not find out until almost 2 
weeks later on May 16th. 

Question 3a. Do you recall your reaction when you found out about this? 

Question 3b. Did you inquire why something of this magnitude took almost 2 
weeks to reach your desk? 

Question 3c. When did you become aware that your Chief of Staff knew this infor- 
mation a week earlier? 

Question 3d. Do you know why you were not told at that time of what had hap- 
pened? 

Question 3e. Is it customary for important matters such as this to be caught up 
in bureaucracy for 2 weeks or is there a system in place to get things to you 
quicker? If so, do you know why this information did not get to you sooner? 
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Since 2001, the VA Inspector General has warned that access controls were a 
“material weakness” in the department’s security of information. Vulnerabilities 
cited included operating systems, passwords, and a lack of strong detection alerts. 
While this case involved a VA employee with authorized access to sensitive informa- 
tion, I am concerned the VA is also vulnerable to a cyber-attacker without author- 
ized access that breaks into the system and removes sensitive information. 

Question 4a. Mr. Secretary, how vulnerable is the VA to a cyber-attack from some- 
one outside of the VA who has no authorization to any VA information? 

Question 4b. Were you aware of the VA Inspector General’s reports that were crit- 
ical of the department’s information protection systems? 

Question 4c. What actions has the department taken to improve information secu- 
rity since you became Secretary in February, 2005? 

Response. VA did not respond to the questions. 


Written Questions Submitted by Hon. Pete V. Domenici to 
Hon. R. James Nicholson 

Question 1. In recent years identity theft has become a major issue in this coun- 
try. Given that the theft of personal information is nothing new, what policies and 
procedures did the Department of Veterans Affairs have in place prior to this inci- 
dent to insure the personal data of our Nation’s veterans was protected? 

Question 2. It is my understanding that to date there is no evidence anyone has 
illegally used the missing data belonging to 26.5 million of our Nation’s veterans 
including names, social security numbers, and dates of birth. However, I am par- 
ticularly concerned for those veterans who are retired or nearing retirement and 
who may be on a fixed income and therefore less able to respond to the con- 
sequences of identity theft. How is the VA preparing to minimize the disturbance 
to their lives in the event this stolen information is improperly used? Furthermore, 
what steps has the VA taken to notify the 26.5 million veteran’s involved in this 
incident? 

Question 3. In light of this loss of information, I think it is clear the Department 
of Veterans Affairs must take steps to better protect sensitive personal data in the 
future. At this time, what changes has the VA implemented or plans to implement 
to insure veterans do not have to face the fear of their personal information being 
misused in the future? 

Response. VA did not respond to the questions. 


Written Questions Submitted by Hon. Lincoln D. Chafee to 
Hon. R. James Nicholson 

Question 1. Members of our military have risked their lives in service of our coun- 
try. Our grateful Nation fully supports veterans programs, including medical, edu- 
cational, employment, and other assistance. I too support these important programs. 
In all times, and especially in a time of war, ensuring our veterans receive the best 
medical care is our Nation’s duty. Earlier this year, in his budget request, the Presi- 
dent proposed higher fees and co-pays for certain veterans receiving VA assistance. 
In my view, a policy that leads to increased denial of service to veterans is simply 
unacceptable, which is why I cosponsored an amendment to the Budget allocating 
money for the government to cover these costs. Secretary Nicholson, what are you 
doing to make sure quality VA care remains accessible to all veterans who need it? 

Question 2. Battlefield medicine has made huge strides in the last few decades. 
The result has been a much higher percentage of wounded soldiers living through 
their initial injuries, able to return home to their families. These wonderful ad- 
vances in medicine deserve our praise, but they mean that the VA will be caring 
for more and more injured soldiers as they return home. Many of these injuries, 
such as burns, amputations, blindness, and PTSD, are of the type that will require 
care for a lifetime. How is the VA preparing for an increase in the number of vet- 
erans who will require long term medical assistance? Furthermore, how is the VA 
making sure it immediately cares for returning Iraq War veterans, but does not for- 
get about those older veterans who continue to require medical assistance? 

Response. VA did not respond to the questions. 

Chairman Craig. Mr. Secretary, thank you very much. 

As you have noted, the Secretary is accompanied by Tim 
McClain, who is General Counsel for the Department of Veterans 
Affairs. 
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You will notice there are two empty chairs. George Opfer, Inspec- 
tor General for the Department of Veterans Affairs, I do not know 
if he was held hostage. At least he was detained in the U.S. House 
of Representatives. And I understand he is en route or nearly here. 
So the moment he arrives, we will allow him to make his statement 
before we go to questions. In the meantime, I will ask the Sec- 
retary a question. 

Mr. Secretary, you have mentioned, as many of our colleagues 
here have mentioned, that there has been a long history of Inspec- 
tor General review and litany recommending greatly improved in- 
formational technology security at VA. In fact, a grade of “F” and 
the word flunk have been used. 

I do not know if this is the ultimate wake-up call, but it most 
assuredly appears to be. 

Does VA have some legitimate reason why it ignored IT security 
recommendations from the IG for 4 years running? 

Now I know your watch has not been during all of those periods 
of time. But I am greatly concerned that it took something like this 
to begin to unravel the rigidity of a bureaucracy that would deny 
the legitimate approach of an overall encompassing IT system that 
now we must get at the business of doing. 

Your reaction. 

Secretary NICHOLSON. My reaction, Mr. Chairman, is that there 
is no excuse for this. I have been there 15 months and I am aware 
of those previous years’ reports and the assessment that we got. 
We did launch this significant change in the way that we are going 
to do IT business by pulling it back and centralizing it, which 
would give us considerably more control and accountability. But 
that is just in the launch phase. 

I also have discovered that there have been directives that have 
been issued by my predecessor to which there has been no atten- 
tion given. There are directives that have come out which are 
called guidelines, which some employees do not interpret as being 
mandatory or operative to them, because they are a guideline. I 
have had that discussion just yesterday with some employees in 
that respect. 

So the whole thing needs to really be tightened up. We are on 
that path, I will say, and give the recently departed CIO credit for 
getting us there. But it is nascent, just starting. 

Chairman Craig. Mr. Opfer, we appreciate your being able to 
make it. 

We will allow you to sit down and take a deep breath, and we 
would ask that you — the Secretary has just completed his state- 
ment and we were just starting into a round of questions. But we 
want you to make your statements so that the questions of my col- 
leagues can be directed to either of you. 

You are accompanied by Jon Wooditch is that correct? 

Mr. Offer. Yes, sir. 

Chairman Craig. Deputy Inspector General, Department of Vet- 
erans Affairs. 

So Mr. Inspector General, please proceed with your statement, if 
you would, please. 
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STATEMENT OF HON. GEORGE J. OFFER, INSPECTOR GEN- 
ERAL, DEPARTMENT OF VETERANS AFFAIRS; ACCOMPANIED 

BY JON A. WOODITCH, DEPUTY INSPECTOR GENERAL, 

DEPARTMENT OF VETERANS AFFAIRS 

Mr. Offer. Thank you, Mr. Chairman and Members of the Com- 
mittee. Thank you for the opportunity to testify today on the loss 
of VA sensitive data. 

I am prepared to give a short statement and request that my full 
statement be submitted for the record. 

Chairman Craig. Without objection, it will. 

Mr. Offer. I am accompanied, as you said, Mr. Chairman, by 
Jon Wooditch, the Deputy Inspector General, and Mike Stanley, 
the Assistant Inspector General for Audits. 

My statement will focus on the incident involving a VA employee 
who took home sensitive data and confidential information which 
was stolen from the employee’s home when it was burglarized. 

Our involvement in this matter from the IG perspective is three- 
fold. One, an ongoing criminal investigation into the theft of the 
data. Two, an administrative investigation. And three, a review of 
the VA policies and procedures for using and protecting privacy 
data. 

In addition to discussing each of these reviews, my statement 
will also provide an overview of the OIG reports that have shown 
the need for continued improvements in addressing information se- 
curity weaknesses in VA and the status of those OIG recommenda- 
tions for corrective action. 

On May 3rd, the home of a VA employee was burglarized. Ac- 
cording to the employee, information stolen included the names, 
birth dates and Social Security numbers of approximately 26.5 mil- 
lion veterans that was stored on his personally owned computer 
hardware. The employee said that he routinely took sensitive data 
home to work on and has been doing so since 2003. 

On Wednesday, May 10th, an Information Security Officer of the 
OIG, while attending a routine meeting at VA, heard that a VA 
employee’s home had been burglarized and that VA electronic 
records may have been stolen. Following the meeting, the OIG em- 
ployee gathered additional facts about the incident. On the fol- 
lowing day, he submitted a written report to alert the Office of In- 
vestigations of the Office of Inspector General. 

On May 12th, the OIG opened a criminal investigation and initi- 
ated efforts to locate and interview the employee and those others 
that had information regarding the theft of the sensitive data. 

On May 15th, we interviewed the employee. The employee ad- 
vised us that he believed several electronic files containing veteran 
information stored on his personally owned computer hardware had 
been stolen during a burglary. He thought that stolen information 
included the names, birth dates and Social Security numbers of ap- 
proximately 26.5 million veterans. 

On May 16th, we met with the Montgomery County Police De- 
partment, who had initiated an investigation of the burglary. We 
informed the Montgomery County Police Department of the sus- 
pected loss of millions of veterans’ personal identifiers. We learned 
that the detectives were actively pursuing leads developed in a 
number of recent burglaries in the employee’s neighborhood. 
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On May 17th, we advised the FBI and the Assistant United 
States Attorney of the details of the burglary and the possible loss 
of the data. On the next day, we also faxed a letter listing these 
details to the FBI. 

Since then we have been conducting a joint investigation focused 
on the recovery of the stolen data. To date, we have received no in- 
dication or information that the data has been further com- 
promised. 

In the administrative investigation, our investigation will deter- 
mine if notifications of the incident were made, and if those notifi- 
cations were pursued in an appropriate and timely manner. We are 
developing a chronology of when key staff and managers were in- 
formed of the incident, what information was conveyed to these in- 
dividuals, and what actions they took. 

As part of the investigation, we will determine if the work the 
employee was performing at home was related to his official duties 
and if he had appropriate authorization to take individually identi- 
fiable data to his residence. We will also determine if the employee 
complied with relevant policies and procedures. 

The recent incident also raises concerns about whether VA has 
adequate policies and procedures in place to protect confidential 
and privileged information maintained in VA electronic databases. 
To address this issue, we have initiated a review to determine 
whether VA has effective policies to ensure compliance, whether 
VA employees are aware of these policies, and whether there is an 
effective mechanism for reporting violations and taking appropriate 
actions. 

The review will identify strengths and weaknesses in VA policies. 
We will make recommendations for improvement to ensure the 
data maintained by VA is protected from unwanted intrusion and 
disclosure. 

In closing, I would like to assure the Committee that this matter 
will remain the highest priority in the OIG until it is resolved. I 
will assure you that all of the resources that we have that are 
needed to complete our reviews in a thorough and timely matter 
will be dedicated to the goal of recovering the stolen data and pro- 
tecting the Nation’s veterans. 

Mr. Chairman and Members of the Committee, thank you again 
for the opportunity to appear and to answer any questions. 

Prepared Statement of Hon. George J. Offer, Inspector General, 
Department of Veterans Affairs 

introduction 

Mr. Chairman, Madam Chairman, and Members of the Committees, thank you for 
the opportunity to testify today on the loss of Department of Veterans Affairs (VA) 
sensitive data. I am accompanied by Jon Wooditch, Deputy Inspector General, and 
Mike Staley, Assistant Inspector General for Auditing. My statement will focus on 
the incident involving a VA employee who took home sensitive and confidential in- 
formation, which was stolen when the employee’s home was burglarized. The Office 
of Inspector General’s (OIG) involvement in this matter involves a three-pronged ap- 
proach including (1) a criminal investigation, (2) an administrative investigation of 
the handling of this matter once reported to the Department, and (3) a review of 
VA policies and procedures for using and protecting privacy data. In addition to dis- 
cussing each of these reviews, I will also provide an overview of the OIG reports 
that have shown the need for continued improvements in addressing information se- 
curity weaknesses in VA, and the status of OIG recommendations for corrective ac- 
tion. 
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On May 3, 2006, the home of a VA employee was burglarized. According to the 
employee, the information stolen included the names, birthdates, and social security 
numbers of approximately 26.5 million veterans that was stored on personally 
owned computer hardware. The employee, a data analyst, was authorized access to 
sensitive VA information in the performance of his duties and responsibilities. He 
said that he routinely took such data home to work on it, and had been doing so 
since 2003. 


CRIMINAL INVESTIGATION 

On Wednesday, May 10, 2006, our Information Security Officer (ISO), while at- 
tending a routine meeting at VA Central Office, heard another ISO mention that 
a VA employee’s home had been burglarized and that VA electronic records may 
have been stolen. Following the meeting, our ISO gathered additional facts about 
this incident. On the following day, he submitted a written report to his supervisor 
for the purpose of alerting our Office of Investigations. On May 12, 2006, a criminal 
investigation was initiated and efforts commenced to identify and interview the em- 
ployee. 

On Monday, May 15, 2006, we interviewed the employee. The employee advised 
us that he believed that several electronic files containing veteran information 
stored on personally owned computer hardware had been stolen during the burglary 
at his home on May 3, 2006. He thought the stolen information included the names, 
birthdates, and social security numbers of approximately 26.5 million veterans. 

On May 16, 2006, we met with the Montgomery County Police Department who 
had initiated an investigation of the burglary when notified on May 3, 2006. We in- 
formed them of the suspected loss of millions of veterans’ personal identifiers. We 
learned that detectives were actively pursuing leads developed in a number of re- 
cent residential burglaries in the employee’s neighborhood. 

On May 17, 2006, we apprised the Federal Bureau of Investigation (FBI) and an 
Assistant United States Attorney of the details of this burglary and possible loss of 
data. The next day, we also faxed a letter listing these details to the FBI. Since 
then, we have been conducting a joint investigation with the FBI and the Mont- 
gomery County Police Department focused on the recovery of the stolen data. To 
date, there has been no indication that this data has been further compromised. 

ADMINISTRATIVE INVESTIGATION 

We have also initiated an administrative investigation to determine if notifica- 
tions of the incident were made, and if those notifications were pursued in an appro- 
priate and timely manner. We are developing a chronology of when key staff and 
managers were informed of the incident, what information was conveyed to these 
individuals, and what actions they took. We are also identifying what V^A electronic 
data the employee stored at his home, whether the employee had an official need 
for the data, why he took it to his home, and who in his supervisory chain approved 
or had knowledge that he had done so. 

We have interviewed the employee, his supervisors, project managers, and co- 
workers; privacy, information security, and VA law enforcement officials; Office of 
General Counsel attorneys, including the General Counsel; and the VA Chief of 
Staff. We are also reviewing electronic mail messages pertinent to the incident; 
notes and memoranda prepared by the employee. General Counsel, and other staff; 
documentation of the employee’s access to VA databases; and other pertinent docu- 
mentation. 

According to the employee, he likely had VA electronic data stolen during the bur- 
glary of his residence, but he was not certain of the type and extent of the specific 
information taken. He said he believed it contained approximately 26.5 million vet- 
erans’ names, social security numbers, and dates of birth, extracted from a VA data- 
base, and possibly other smaller files containing information about individual vet- 
erans was also taken. We are currently reviewing the computer discs he used to 
take data home to determine what other information may have been stolen. 

The employee, a data analyst, had an official need to access the records believed 
to have been stolen. The nature of his work was project-focused and involved manip- 
ulating large quantities of data to address certain policy issues. The employee told 
us he took the data home for work-related purposes. However, none of his super- 
visors we talked to said they were aware that the employee had taken the file con- 
taining approximately 26.5 million veterans’ records to his residence. 

As part of our investigation, we will determine if the work the employee was per- 
forming at home was related to his official duties, and if he had appropriate author- 
ization to take individually identifiable data to his residence. We will also determine 
if the employee complied with relevant policies and procedures in taking this infor- 
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mation home and properly protecting it. Our report will identify what breakdowns 
occurred that may have hindered timely notification and follow-up of this incident. 
Based on our investigation, we will make recommendations for appropriate action, 
if warranted. 

REVIEW OF LAWS, REGULATIONS, AND VA POLICIES AND PROCEDURES 
ON SAFEGUARDING CONFIDENTIAL INFORMATION 

The recent incident raised concerns about whether the VA has adequate policies 
and procedures in place to protect confidential and privileged information main- 
tained in VA’s electronic databases. Our concerns are whether VA policies are ade- 
quate to ensure compliance with information security laws, the Privacy Act and 
other confidentiality laws and regulations, and to identify and take action when 
there is a violation of law or policy. There are two sets of laws and implementing 
regulations to protect the integrity of confidential data — computer security laws and 
confidentiality statutes. While the intent of both sets of laws is the same — the pro- 
tection of information — the approach is different. Computer security laws ensure 
that the system infrastructure on which the data is maintained electronically is pro- 
tected against unauthorized intrusions such as viruses and unapproved access. The 
Privacy Act and other confidentiality laws and regulations protect information by 
limiting access, use, and disclosure of records without authorization from the indi- 
vidual about whom the record is maintained. 

To address the issues, we initiated a review to determine whether VA has effec- 
tive policies in place to ensure compliance with computer security laws, the Privacy 
Act and other confidentiality laws and regulations, whether VA employees are 
aware of the policies; whether VA has adequate procedures in place to monitor com- 
pliance with the policies; and, whether the policies include an effective mechanism 
for reporting violations and taking appropriate action. Two areas that we are ad- 
dressing in our review are policies relating to the transfer of electronic information 
from an employee’s VA computer to his home or alternative work site and the im- 
pact centralization versus decentralization of VA policy has on ensuring that the in- 
tegrity of VA computer systems and the information stored on those systems is 
maintained. 

The review includes identifying and reviewing applicable laws, regulations and 
policies, including Department-wide policies; policies issues by the Veterans Health 
Administration (VHA), the Veterans Benefits Administration (VBA), and other VA 
entities, policies issued by local VA facilities; and mandatory training modules. We 
are also reviewing how policies are disseminated to VA employees; whether VA em- 
ployees are aware of the policies, and whether VA procedures for identifying, report- 
ing and taking action when data has been improperly accessed or improperly used 
are adequate. 

This review will identify strengths and weaknesses in VA’s policies implementing 
the provisions of computer security laws and the Privacy Act, and other confiden- 
tiality laws. We will also identify strengths and weaknesses in ensuring that VA 
employees are knowledgeable regarding their obligation to protect VA computer sys- 
tems and information and that they will be held accountable for violations. We will 
make recommendations for improvement to ensure that data maintained by VA is 
protected from unwarranted intrusion and disclosure. 

SUMMARY OF OIG REPORTS ADDRESSING INFORMATION SECURITY WEAKNESSES 

We have conducted a number of audits and evaluations on information manage- 
ment security and information technology (IT) systems that have shown the need 
for continued improvements in addressing security weaknesses. My office has re- 
ported VA information security controls as a material weakness in its annual Con- 
solidated Financial Statement (CFS) audits since before fiscal year (FY) 2001. Our 
Federal Information Security Management Act (FISMA) reviews have identified sig- 
nificant information security vulnerabilities since fiscal year 2001 that place VA at 
risk of denial of service attacks, disruption of mission-critical systems, and unau- 
thorized access to sensitive data. We continue to report security weaknesses and 
vulnerabilities at VA health care facilities and VA regional offices where security 
issues were evaluated during our Combined Assessment Program (CAP) reviews. 

Consolidated Financial Statement Audits Continue to Report Information Security as 
a Material Weakness 

Pursuant to the Chief Financial Officers Act of 1990, the VA consolidated finan- 
cial statements are audited annually. We contract with an independent public ac- 
counting firm to perform this audit. As part of the audit, the contractor follows Gov- 
ernment Accountability Office methodology to assess the effectiveness of computer 
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controls. The contractor conducts audits at VA’s three information technology cen- 
ters and selected regional offices and medical centers. 

As part of the CFS audit, IT security controls have been reported as a material 
weakness for many years. A material weakness is defined as a weakness in internal 
control of VA systems that could have a material effect on the financial statements 
and not be detected by employees in the normal course of their business. We have 
reported that VA’s program and financial data are at risk due to serious problems 
related to VA’s control and oversight of access to its information systems. By not 
controlling and monitoring employee access, not restricting users to only need-to- 
know data, and not timely terminating accounts upon employee departure, VA has 
not prevented potential risk. These weaknesses placed sensitive information, includ- 
ing financial data and sensitive veteran medical and benefit information, at risk, 
possibly without detection of inadvertent or deliberate misuse, fraudulent use, im- 
proper disclosure, or destruction. 

As a result of these weaknesses, we made recommendations that VA pursue a 
more centralized approach, apply appropriate resources, and establish a clear chain 
of command and accountability structure to implement and enforce IT internal con- 
trols. We also recommended that VA improve access control policies and procedures 
for configuring security settings on operating systems, improve administration of 
user access, and detect and resolve potential access violations. Finally, we rec- 
ommended that VA conform access privileges to the user’s level of responsibility and 
position. 

VA has implemented some recommendations for specific locations identified but 
has not proactively made corrections VA-wide. For example, we found violations of 
password policies which management immediately corrected, but in following years, 
we found similar violations at other facilities. We also found instances of terminated 
or separated employees with access to critical systems identified at various locations 
which management corrected, only to discover similar instances elsewhere. 

Evaluations of VA’s Information Security Program Have Identified Serious 
Vulnerabilities for Several Years That Remain Uncorrected 

FISMA requires us to annually review the progress of the information technology 
and security program of the Department and report the results to the Office of Man- 
agement and Budget. As part of the FISMA review, we conduct scanning and pene- 
tration tests of selected VA systems to assess controls for monitoring and accessing 
systems, and reviews of physical, personnel, and electronic security. We visit all 
three major IT centers and selected VHA and VBA sites. 

In all four audits of the VA Security Program issued since 2001, we reported seri- 
ous vulnerabilities that remain uncorrected. These reports highlight specific 
vulnerabilities that can be exploited, but the recurring themes in these reports are 
the need for centralization, remediation, and accountability in VA information secu- 
rity. Since the fiscal year 2001 report, we reported weaknesses in physical security, 
electronic security, wireless security, personnel security, and FISMA reporting. Ad- 
ditionally, we have reported significant issues with implementation of security ini- 
tiatives VA-wide. The status of unimplemented recommendations was discussed in 
subsequent audits. 

The fiscal year 2004 audit once again emphasized the need to centralize the IT 
security program, implement security initiatives, and close security vulnerabilities. 
We recognized that the CIO’s office needed to be fully staffed, and that funding 
delays and resistance by offices to relinquish their own security functions and activi- 
ties delayed implementation of the fully centralized CIO contemplated by our prior 
recommendations. The CIO’s comments to the report referenced an April 2004 VA 
General Counsel opinion that held the CIO lacked the authority to enforce compli- 
ance with the VA information security program as one reason he could not address 
vulnerabilities. We again recommended that VA fully implement and fund a central- 
ized VA-wide IT security program. 

In total, the fiscal year 2004 report included 16 recommendations: (1) centralize 
IT security programs; (2) implement an effective patch management program; (3) 
address security vulnerabilities of unauthorized access and misuse of sensitive infor- 
mation and data throughout VA demonstrated during OIG field testing; (4) ensure 
position descriptions contain proper data access classification; (5) obtain timely, 
complete background investigations; and complete the following security initiatives 
on (6) intrusion detection systems, (7) infrastructure protection actions, (8) data cen- 
ter contingency planning, (9) certification and accreditation of systems, (10) upgrad- 
ing/terminating external connections, (11) improvement of configuration manage- 
ment, (12) moving VACO data center, (13) improvement of application program/op- 
erating system change controls, (14) limiting physical access to computer rooms, (15) 
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wireless devices, and (16) electronic transmission of sensitive veteran data. As of 
May 23, 2006, all recommendations from this report remain open. 

Finally, in fiscal year 2006, after Congress mandated full centralization of IT se- 
curity under the CIO, as we advocated in our reports since 2001, VA is now moving 
out on a truly empowered centralized CIO. We have provided our draft fiscal year 
2005 audit report to the Department and are working with the Department to re- 
solve all outstanding recommendations. We have grouped our recommendations into 
two categories — the CIO’s authority under centralization and longstanding 
vulnerabilities. With a centralized CIO with direct line authority to implement the 
needed fixes, we believe VA has a unique opportunity to successfully address all the 
vulnerabilities and weaknesses discussed in our reports since 2001. 

We believe centralization is essential because standardization is the key to fixing 
VA information security weaknesses. As long as three stove-piped administrations 
and other smaller component organizations are free to operate in the IT environ- 
ment on their own within VA — accountable not to the CIO but to other line man- 
agers who themselves are not accountable to the VA CIO — the vulnerabilities cannot 
be effectively resolved. 

CAP Reviews Continue To Show Information System Security Vulnerabilities Con- 
tinue To Exist 

We continue to identify instances where out-based employees send veteran med- 
ical information to the VA regional office via unencrypted e-mail; system access for 
separated employees is not terminated; monitoring remote network access and 
usage does not routinely occur; and off duty users’ access to VA computer systems 
and sensitive information is not restricted. We continue to make recommendations 
to improve security and contingency plans, control access to information systems, 
complete background investigations and annual security awareness training, and 
improve physical security controls. 

While individual and regional managers have concurred with these CAP rec- 
ommendations, and our follow-up process confirms actions to resolve the specific 
conditions identified at these sites, we continue to find that corrective actions are 
not applied to all facilities to correct conditions nationwide. Consequently, we con- 
tinue to find these systemic conditions at other sites we visit. For example, between 
FYs 2000 to 2005 the CAP program identified IT and security deficiencies in 141 
of 181 VHA facilities. We identified IT and security deficiencies at 37 of 55 VBA 
facilities. 


CLOSING 

In closing, I would like to assure the Committee that this matter will remain a 
very high priority for the OIG until it is resolved. I will ensure that all the resources 
that are needed to complete our reviews in a thorough and timely manner will re- 
main dedicated to the goal of recovering the stolen data and protecting our Nation’s 
veterans. 

Mr. Chairman, Madam Chairman, and Members of the Committees, thank you 
again for this opportunity and I would be pleased to answer any questions that you 
may have. 

Chairman Craig. Mr. Opfer, thank you for being here and thank 
you for that testimony. 

Let me turn to Chairman Collins. 

Susan. 

Chairman COLLINS. Thank you, Mr. Chairman. 

Mr. Secretary, first let me say to you that I do not doubt in any 
way your personal pain and your sense of outrage over what has 
happened. I know you are sincerely upset and that you are dedi- 
cated to remedying the problems. 

The chronology that you gave us in your testimony is absolutely 
baffling. This was not a minor security breach. It involved personal 
information about 26 million veterans. And it is just inconceivable 
to me that there were such long delays in informing you personally 
and in informing the veterans who were affected. 

The concern I have, however, with your testimony, is that you 
seem to be saying that it was just one employee. It was one em- 
ployee who breached the trust of our Nation’s veterans. But in fact. 
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it is not just one employee. You have a high risk vulnerable system 
that has been identified time and again as vulnerable. 

I have a stack of just some of the reports from 0MB, from the 
House, from the GAO, from the Inspector General’s office. Over and 
over again, it is the same warning, the same conclusions, the same 
recommendations. 

For example, in this 2003 annual audit by the IG, it states, “The 
security vulnerabilities identified represent an unacceptable level 
of risk.” And then the IG goes on to make many recommendations. 

But here is what is most startling to me. For almost every rec- 
ommendation, there is a notation that says the following: “This is 
a repeat recommendation from the fiscal year 2001 and 2002 infor- 
mation security audit.” 

Similarly, a report by the IG just last year states. 

Our last four annual audits, as well as this year’s, continue to show signifi- 
cant security vulnerabilities. We continue to find that the VA systems remain 
vulnerable to unauthorized access and misuse of sensitive information and data. 

It seems to me that you and the leaders in your Department were 
on notice. Were you aware of these repeated audits and reports 
that identified such serious vulnerabilities? 

Secretary NICHOLSON. Yes, I was. Senator Collins. 

And as I said earlier, that is one of the compelling reasons that 
we have really taken the steps we did to centralize our systems, 
our information system, so that we have tighter central control 
over these. Because it has gotten very decentralized, very loose and 
undisciplined. We have really taken some very significant steps, 
and there is just a change. I mean, the reassignment of thousands 
of people, the rebudgeting, the creation of a career field for IT per- 
sonnel at the VA, which had not existed. 

But it is just underway. But it has taken, in response to this sit- 
uation that was very evident, and other deficiencies that have ex- 
isted there which are not germane things like business accounting, 
inventory control reports and so forth, that you get out of a central- 
ized IT system that the VA has just gotten away from over the last 
couple of decades. 

Chairman CoLLiNS. Mr. Opfer, are you satisfied with the re- 
sponse to your office’s recommendations? 

Mr. Offer. Senator Collins, I have recently been appointed to 
the Inspector General since November. Jon Wooditch is the Deputy 
Inspector General, who also served as Acting IG, and has much 
more familiarity with the series of reports over the years. I am 
going to refer to Jon to respond to this. 

Chairman CoLLiNS. Mr. Wooditch. 

Mr. Wooditch. Thank you. 

No, we have not been satisfied with the response in the past. As 
you mentioned, we have repeated these recommendations year in 
and year out. The IT system has been considered a material weak- 
ness in the Department for 5 straight years.se on. 

In the last report that we put out, which was March 2005 of fis- 
cal year 2004 activities, we listed 16 recommendations and many 
of those are repeat recommendations. 

I would like to add that in Mr. Opfer’s statement for the record, 
we do recognize that Congress took efforts this year to centralize 
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IT in the VA. We think that presents a very unique opportunity 
now for VA to address these recommendation. 

Chairman COLLINS. Thank you, Mr. Chairman. 

Chairman Craig. Thank you, Madame Chair. 

Senator Akaka. 

Senator Akaka. Thank you very much, Mr. Chairman, Madame 
Chair. 

Mr. Secretary, VA seems to believe that it is unlikely that the 
lost data will be used by the thief, and you mentioned that in your 
statement. Is that the judgment of law enforcement officials? 

Secretary Nicholson. Senator Akaka, if I gave you that impres- 
sion, I did not mean to, that we think it is unlikely. What I was 
trying to say was that we think it was unlikely that the burglary 
was committed to get after that data. 

Senator Akaka. Mr. Secretary, it is my understanding that typi- 
cally VA will scramble Social Security numbers based upon an 
encryption formula. Access to files that translate scrambled Social 
Security numbers is only possible with special authorization. Real- 
izing the sensitivity of this data that was burglarized, was this 
data not scrambled? 

Secretary Nicholson. That is correct. Senator Akaka, it was not 
scrambled. There is a requirement for those who are authorized to 
take data home or to work with data at home that it should be 
encrypted, and this was not. 

Senator Akaka. Can you tell me, Mr. Secretary, what years of 
veterans this data covered? Does it date back to 1970 or 1960? 

Secretary Nicholson. My understanding of it is that it is all vet- 
erans that were discharged from the services since 1975, plus vet- 
erans receiving disability compensation from our Department. The 
reason that we have that data is that there is a form that — I do 
not know if you remember — ^but when you are discharged the De- 
partment of Defense issues a form called a DD-214. And that is 
the record of your service, time, awards, so on. 

And we, the VA, are an addressee on a copy of that for everybody 
that gets discharged. All of these veterans in this file are not re- 
ceiving benefits from the VA, but we have them in our data file. 

Senator Akaka. I am asking that just so that veterans out there 
realize if they were discharged before that date, that their records 
were not in this 26.5 million data. Thank you. 

Mr. Opfer, can you reveal anything more about the criminal in- 
vestigation that would comfort the Nation’s veterans that the em- 
ployee and the data were not targeted? 

Mr. Offer. Yes, Senator Akaka, without compromising the inves- 
tigation, I can say that the evidence to date indicates that the per- 
petrators of the burglary were specifically targeting computer hard- 
ware. There were a number of similar burglaries in the area where 
storage devices and computers, hardware, CDs, et cetera, were sto- 
len. And it matches the similarity of a number of burglaries, in- 
cluding petty change, but very valuable items were left in the 
house. This fits the same pattern that Montgomery County Police 
have been seeing in a number of burglaries in the area. 

Also, our investigators have interviewed the employee a number 
of times and have gone to his house. We recovered a number of 
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CDs and other equipment that contained VA sensitive data that 
was left in the house. 

So appearing from the similarity of the burglaries, with other 
regular house burglaries, and the fact that VA data that we are 
able to secure was still there, we do not believe there was any in- 
formation that has been developed by the Montgomery County Po- 
lice, the Office of the Inspector General Investigators, or the Fed- 
eral Bureau of Investigation that would indicate that that em- 
ployee himself was targeted for the fact that he was in possession 
of that VA data. 

Senator Akaka. The Secretary did mention that it appeared this 
burglary was at random. What is your reading on that? 

Mr. Offer. From our conversations with the police and from my 
own experience, I have been in law enforcement since 1969, this 
fits the pattern that would be, that they would do some surveil- 
lance of residences to see when people come in and out, and if you 
work a routine. And this employee and his spouse were on a very 
regular routine. It fits the pattern of the burglaries in that area. 

So, I would say they kind of identified residents who would be 
vulnerable during certain periods of time and then committed those 
crimes. 

Senator Akaka. Thank you very much, Mr. Chairman. 

Chairman Craig. Danny, thank you very much. 

Senator Murray. 

Senator Murray. Mr. Secretary, I am trying to reconcile the 
numbers here. You are talking about 26.5 million records com- 
promised. We have about 25 million veterans who are alive in the 
U.S. today. Six million of them are enrolled in the VA. So I want 
to get something straight. Does the lost data include spouses of vet- 
erans that would account for those number misconceptions? 

Secretary Nicholson. Senator Murray, some of the veterans on 
this list would be deceased, but would not have been expunged 
from the rolls, and that explains most of that. 

There were, however, some spouses. 

Senator Murray. Whose spouse has passed away and they are 
in the database? 

Secretary NICHOLSON. Yes, I am told. 

Senator Murray. That raises two questions. First of all, how are 
you doing outreach to all of these 26.5 million names, particu- 
larly — I mean, we have had a lot of press about veterans them- 
selves. But I am certain that there are spouses out there who have 
no idea that their name is part of this. 

I would like to know if we are getting outreach to them to notify 
them. 

Secretary Nicholson. Well, we are doing all we can to get the 
message out the way we have, through the use of the media. And 
we are preparing a mailing that will go to everyone. 

Senator Murray. To all 26.5 million names? 

Secretary Nicholson. Yes, because we do not know those that 
have died. 

Senator Murray. And the cost of that? 

Secretary Nicholson. We are working on that. We are trying to 
buy envelopes right now, for example. There is not immediately 
available 26 million envelopes. 
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Senator Murray. What account are you taking that from? 

Secretary NICHOLSON. We have been in and asked for reprogram- 
ming of some administrative money, and that was $25 million, 
which was to cover the mailing plus, the cost of the phone centers. 
The mailing itself, we think, will be in the range of $10 million to 
$11 million. 

Senator Murray. That is significant in a very tight budget, so I 
am certain we will be hearing from you on the need for additional 
funds for the VA? 

Secretary NICHOLSON. You will be hearing from us, I think on 
different levels, because I think we also have things we have to do 
for our veterans with respect to trying to find a monitoring system 
that is practical for watching over this for our veterans to try to 
alleviate the anxiety that they have about it, we have something 
in place to watch, working with the three major credit bureaus. 

Senator Murray. I expect this will cost a great deal. I want to 
make sure that our veterans do not get a double whammy of not 
only losing their records, but then being denied services because 
costs are not covered. I want to make sure we are providing the 
additional dollars to cover this. So I hope we can hear from you 
soon. 

Let me ask you, as well, are you reaching out to VSOs to help 
our veterans? 

Secretary NICHOLSON. Yes, we are. 

Senator Murray. And give them the training that they need to 
deal with this? 

Secretary Nicholson. We have certainly been in communication 
with them. We have not initiated any training with them so far. 
We are trying to use them and they are cooperating to be a commu- 
nicator. 

Senator Murray. I would suggest we look at some kind of train- 
ing for the VSOs. That is usually who the veterans call first. And 
they, I am positive, do not have some of the training they need to 
do that. 

I would also like to ask how you are dealing with veterans who 
do not have access to the Internet, who do not know how to use 
the technology. Many of our older vets who struggle with this kind 
of information, how are we dealing with them? 

Secretary Nicholson. I think that is a very important question. 
I have been talking about that myself. My father was a veteran. 
He did not know how to boot up a computer. 

So we obviously have the phone banks in the mailing that we 
will be sending out. There will be other information that they can 
use and ways to communicate outside of the computer. 

Senator Murray. Have you ever gotten your credit checked, as 
you suggest, on the VA Web site? 

Secretary NICHOLSON. I have not, no. 

Senator Murray. It is not easy to do. So I am hoping that you 
are looking at additional staff to be able to answer the questions 
and work their way through that. It is not the easiest system, par- 
ticularly for anybody, but for our vets who are personally worried 
right now, as well. 

Mr. Chairman, I also think we need to be very conscious that we 
are reaching out now to 26.5 million veterans. We have about 5 
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million who are using VA services now. We are essentially noti- 
fying 20-some million veterans that they are eligible for services. 
There will he the impact. We have a responsibility to make sure 
they get the services they need. 

And I hope we are looking critically at the impact on our budget, 
not only for the outreach, the additional training, making sure ev- 
erybody gets the information they need, but also on the impact to 
our VA budget as more veterans are notified that they do have ac- 
cess to services. 

Chairman Craig. Senator, thank you for that concern. It is our 
concern. It is the Committee’s concern. Obviously, by actions taken, 
it is the Secretary’s concern. 

We will monitor it closely as this progresses to make sure that 
the resources are available to outreach in the appropriate fashion. 

You mentioned widows and it is obvious to me, I think and oth- 
ers, that there are widows on this list. This morning I was doing 
C-SPAN on this issue and the call-in and I got a call from a widow 
who was obviously very concerned that in some way her financial 
statements and records might have been compromised. So that cer- 
tainly is a legitimacy to this kind of list and the size of the list in- 
volved. 

Thank you. 

Secretary NICHOLSON. Could I comment on that, Mr. Chairman? 

Chairman Craig. Please. 

Secretary NICHOLSON. My technical people just handed me a note 
that says that the only spouses on that file, we think right now, 
were the spouses in a file of people involved with mustard gas. And 
that involves a number of less than 100. 

Senator Murray. Then the discrepancy between the 25 million 
veterans who are alive today and the 26.5 million records that you 
are talking about, that is 1.5 million people and only 100 are 
spouses. Who are these people? 

Secretary NICHOLSON. They are probably deceased. Senator Mur- 
ray, 1800 veterans die every day in our country. 

Senator Murray. OK, and so does somebody else — I mean, I am 
assuming that their records can be used and compromised, as well. 
Are we notifying relatives or anybody else to be aware of that? I 
am not sure how this technically works, but it does raise concerns. 

Secretary Nicholson. What we plan to do is to mail that entire 
list in the hopes that if there is an address and a survivor at that 
address, they will get that notice. 

Senator Murray. If it goes to the person, it will be returned, I 
am assuming, so how would their families know? 

Secretary NICHOLSON. That is a good question. We will have to 
look at that. Your concern being the use of the identity of a de- 
ceased veteran. 

Senator Murray. Right. 

Secretary NICHOLSON. That is a good question, and I cannot an- 
swer it right now. We will have to look at that. 

Chairman Craig. Those are very legitimate questions. 

I think as you are able to unravel this, Mr. Secretary, it becomes 
very important for all of us, and especially for you, to understand 
those kinds of nuances and details, and that that information flow 
go public. I have to think that is very important. 
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Thank you, Senator. 

Senator Isakson. 

Senator Isakson. Inspector Opfer, do the Inspectors General of 
the various agencies of the Federal Government ever meet to- 
gether? 

Mr. Offer. Yes, all the Inspectors General of the agencies are 
members of what is called the President’s Council on Integrity and 
Efficiency. We meet formally once a month. And the chairman of 
that is the Deputy Director for Management for 0MB. And one of 
the Inspectors General is selected as the vice-chair. Then there are 
various committees of the PCIE, the Investigations Committee, 
Audit Committee, and Inspections, Evaluations, and Legislative. 

Senator Isakson. I have two suggestions. One is it would seem 
to me the Secretary has outlined his disappointment at being noti- 
fied 13 days after the fact, that we should immediately install in 
the various agencies of the Government a rule that any breach of 
secure information and data is to be immediately reported to the 
person in charge. And I am talking about the secretary of the agen- 
cy. I am not talking about the Department. 

Something like this should never go unknown by the boss. The 
Secretary, to his credit, accepted the blame, the buck stops here, 
and I appreciate his doing that. But I also acknowledge how tough 
it is to find out 13 days after the fact what you are going to have 
to take the blame for. 

So I would suggest that you all talk about what ought to be a 
Governmentwide policy, if there is any other breach. All that takes 
is a policy change. 

The second thing is that if, in fact, other agencies have informa- 
tion as accessible as the Secretary has described the information at 
the VA is, then I think the inspectors general need to make rec- 
ommendations to the appropriate agency or authority, which is 
probably the Appropriations Committee of the U.S. House and Sen- 
ate, as to what should immediately be done to put blocks and secu- 
rity on that information, so it cannot be accessed from the outside 
nor be portable enough to be taken out. 

So I would just recommend you do that. That is important. We 
have inspectors general to hold us accountable, to find discrep- 
ancies, to point things out that we need to do. We have a situation 
here that clearly demonstrates that a couple of changes need to be 
made. 

Any comments you have? 

Mr. Offer. Yes, Senator. Just on this issue alone, I have been 
contacted by a number of inspectors general of these various agen- 
cies themselves, and including some deputy secretaries of depart- 
ments. So when we conclude our review, I would be willing to dis- 
cuss that with them and the individual things. 

In the normal process, I am a member of the Investigations Com- 
mittee of the President’s Council on Integrity and Efficiency and 
also the Inspection and Evaluation. We would make this available 
and make a presentation on to all of the inspectors general, includ- 
ing the officials of 0MB at the PCIE meeting, as well as giving 
them the reports and briefing the appropriate members of the Ap- 
propriation Committee on both sides of the Hill and the Oversight 
Committees. 
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Senator Isakson. Mr. Secretary, this is really a comment. Hav- 
ing had my identification taken, and having heen notified by the 
company that lost it or allowed it to get out, I am aware of what 
happens in the private sector. What happens is they provide a 
means of protection for a period of time in the event the theft of 
the information actually gets in the wrong hands and is accessed. 

As you are investigating your cost to deal with the mailing and 
with the czar, or whatever else you do in the Department, I would 
suggest that you consider in the hopefully unlikely circumstance 
that if we find this information is accessed, we need to know how 
to deploy immediate security measures for these 26.5 million peo- 
ple and what that cost would be. 

From talking with the Chairman yesterday, that type of product 
is available. And its cost, in the volume like this, is not as insur- 
mountable as one might initially think. 

So, I think as we are planning for how to prevent this from hap- 
pening in the future, and we are budgeting for notification, there 
should be some investigation by the VA as to what we are going 
to do if the unlikely event happens and the information actually 
gets used inappropriately. 

So, I would appreciate your thinking about that. 

That is all I have, Mr. Chairman. Thank you, Mr. Chairman. 

Chairman Craig. Johnny, thank you very much. 

Senator Thune. 

Senator Thune. Thank you, Mr. Chairman. I appreciate that 
suggestion, as well as some of the others. 

I think a lot of the questions that have been raised today are 
very good questions, particularly with respect to the short term, no- 
tifying veterans how the agency, the Department intends to do 
that, as well as it just seems like this was a tremendous break- 
down in the chain of command when it came to reporting the inci- 
dent, considering the magnitude of this breach. So, I think the sug- 
gestion that my colleague from Georgia made regarding the IG and 
how that is reported is a good one. And it seems to me, at least, 
there has got to be some change in that area, as well. 

I am also concerned, obviously there are a lot of short-term impli- 
cations to this and many of those have been raised and touched 
upon. I also am concerned about, as well, the long term. As has 
been noted already, many of the reports that have been done in the 
past by the IGs and other agencies of Government, watchdog and 
audit agencies, have suggested weaknesses and fiaws in the IT sys- 
tem at the VA. 

What I would like, Mr. Secretary, just to get you to comment on, 
is because one of the things that we have been talking about a lot 
up here is centralization of that function at the Department, rather 
than having these compartmentalized different databases out there 
that contain information on our veterans. 

I know that recently here the VA CIO, Mr. McFarland, resigned 
because the VA was not moving fast enough on the IT organization. 
My understanding is, as well, that he was brought on board specifi- 
cally because of his expertise as a former executive at Dell Com- 
puter, and was supposed to be an agent for change for the VA 
when it comes to reform of the IT programs. 
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At least the reports I have read suggest that he became frus- 
trated beating his head against the wall of the bureaucracy at the 
VA and that, as a consequence, decided to leave. But I think it 
points to this broader question of IT management centralization 
and the privacy of the 26 million records that we are talking about 
today. 

But could you just talk a little bit about the context of his depar- 
ture and your view about whether or not the VA is moving quickly 
enough when it comes to adopting the federated model of IT man- 
agement centralization? 

Secretary NICHOLSON. I can. Senator. 

It is hard to say what Bob McFarland is feeling when he is not 
here. I had lunch with him shortly before he left, and I think that 
he feels quite satisfied about what he achieved at the VA. The 
statement about his getting tired of bumping his head against the 
wall, I think he got tired of doing what he had to do to break 
through to get done what we were doing. 

It did not become a totally adopted model that Mr. McFarland 
wanted because there is one exception in there, which is the devel- 
opers of IT. These are the people that work to customize the appli- 
cations of software for research going on at different hospitals and 
so on. 

But short of that, he achieved everything he set out to do. So, 
I think he made a monumental contribution to the VA. 

He wanted to get back and spend more time fishing. He thought 
he probably bumped enough heads and wrangled enough people 
doing what he got done, that maybe it was time for him to leave. 
I tried to talk him out of it. 

The important thing though is what he is leaving behind, with 
respect to what is going on now. It gives us a chance to be very 
hopeful. 

Now you ask me are we moving fast enough? I would say to that, 
no. I do not think anything, frankly, moves in the Government fast 
enough. Because there are both the embedded cultural resistances 
to this in the bureaucracy and there are a lot of regulations and 
laws that inhibit speed. 

But having said that, I will say that something very important 
has happened, and that is that the institutional resistance that 
was there to this big change has gone away. Those leaders are now 
very supportive of this and are working honestly and harmoniously 
in getting this done. 

But it involves the reclassification of thousands of people and the 
upheaval and anxiety that goes with that. As I said, I think I said, 
that it also will result in a new career field in the VA for informa- 
tion technology, which would give those people a chance to go up 
in their own field without having been piggybacked into IT from 
some other field that they came from. So it is a real advantage to 
them for that, as well. 

We have a team of really young, bright IT people who have the 
responsibility for this implementation. And they are underway. 

Senator Thune. I appreciate that, and Mr. Chairman we have 
had this discussion. I hope that you can continue to push the pace. 
I know there is resistance to change in every agency of Government 
and bureaucracy. It is just human nature as much as anything 
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else. But the stakes in this dehate are so high and the relative 
speed with which this transition has occurred seems to me to sug- 
gest that we are not doing enough. 

I am glad to hear you say that the culture is changing, because 
I think that is important, too, to recognize that this is where we 
are going. And once you get over that hurdle, then how do we get 
there in the quickest, most efficient way possible. 

But this incident obviously focuses a lot of light on the impor- 
tance of that transition happening, particularly in light of many of 
the reports and suggestions and recommendation that have come 
previously that appear not to have been adhered to. 

So, we are obviously all looking for not only trying to determine 
exactly what caused this breach, but also, more importantly now, 
what we must do to fix it. So I thank you, and Mr. Chairman I 
have another question, but I am out of time and I think we have 
a vote on. So I yield back the balance of my time. 

Chairman Craig. We do have a vote underway. 

Gentlemen, I do have a couple more questions. I think Senator 
Collins does. We will ask you, if you would please, we will be brief 
We should be able to get you out of here within the next 15 or 20 
minutes. I will run and vote and come back. 

So we will ask the Committee to stand in recess until Senator 
Collins returns and then she can bring it to order. 

Thank you. 

[Recess.] 

Chairman CoLLiNS [presiding]. The Committee will come back to 
order. 

Mr. Secretary, I do expect some of our colleagues to return, in 
particular the Chairman. While we are waiting for that, I am going 
to proceed to a couple of additional questions that I have for you. 

For the past 7 years, it is my understanding that the VA and the 
Department of Defense have been working to achieve the exchange 
of patient health information electronically. The goal is to have an 
interoperable electronic health record. 

In addition, the Department of Veterans Affairs is working with 
the IRS and with the Social Security Administration on compiling 
and comparing some means test income data to ensure that non- 
service connected veterans receiving VA health care have the cor- 
rect eligibility. 

I bring these two projects up because both involve a massive ex- 
change of data, personal data, sensitive data in the case of the 
health care and income data. How much confidence do you have 
that there are appropriate safeguards, encryption, limits to access 
the information that is being compiled through these two projects? 

Secretary NICHOLSON. Senator, I would like to tell you that I 
have a lot of confidence, but I am not going to because I do not. 
I think that we have 7.5 million enrolled patients for health care 
at the VA. Every one of them has an electronic health record, 
which is exemplary, and it is one of the main reasons, I think, that 
we are such a very good integrated health care provider. It gives 
portability and safety. 

But I have worries about the fact that people can access this 
from remote stations and whether or not we have the controls in 
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place to limit that access, and what are the possibilities for the 
downloading of it? 

Now I know that we have controls and we have codes and we 
have things that protect that. But I am not going to tell you that 
I think that it is what it should be. 

Chairman CoLLiNS. That is something that I hope the Depart- 
ment will act very quickly to take a look at. 

As I understand it, so far there has been no indication that the 
stolen data has been used for identity theft or financial fraud. And 
of course, all of us are hoping that that pattern will hold. There 
is a concern, however, that con artists could take advantage of this 
situation without having access to this data. I would like to give 
you a scenario that my staff had mentioned to me. 

It would be very easy for a scam artist to call up a veteran, refer 
to this loss of data, pretend to be a VA representative and ask for 
the veteran to verify his or her Social Security number and date 
of birth. 

Are you doing anything through your Web site or the Veterans 
Service Organizations to try to educate veterans on identity theft, 
in general, and that they should be very careful about giving out 
information, and perhaps to inform them that the VA is not calling 
to ascertain this information? 

I just worry that even if this information miraculously is not mis- 
used by anyone, that there are clever con artists who could use the 
fact of this information’s exposure to take advantage of our vet- 
erans. 

Secretary Nicholson. I think it is a good point and we are not 
doing that, to my knowledge. It sounds like something we should 
be and can and will, yes. 

Chairman COLLINS. I think that would be very helpful and 
maybe it is something — Mr. Opfer? 

Mr. Offer. Senator, actually you are right on target. We have 
been made aware of something like that yesterday and have re- 
ported it to the Department senior management. I think that needs 
to be very aggressively put out to the public. But something similar 
like that was reported and I had us bring it to the senior level of 
management. The Chief of Staff is aware of it and the other senior 
officials in the Department. 

Chairman COLLINS. So your concern is that may already be hap- 
pening? 

Mr. Offer. Yes, it would be a usual thing to happen in an event 
like this. 

Chairman COLLINS. It would. I have done work in this area on 
identity theft and the financial fraud and people will take advan- 
tage and exploit every vulnerability. It would be ironic if the stolen 
information were never used for this purpose, but then con artists 
use the fact of this incident to compromise our veterans. 

Mr. Offer. A recent example of that was the tragedy in Fairfax, 
Virginia a few weeks ago, with the two police officers killed. Right 
before they were even buried, they were calling saying that they 
were calling on behalf of the police associations, generating funds. 
So as you have a tragedy, people are ready to come in. 

In my previous experience, I was the Inspector General at the 
Federal Emergency Management Agency. And every time you had 
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a disaster, you had the people, as I referred to them the vultures, 
ready to come down. 

Chairman CoLLiNS. There are always the fraudulent charities 
that pop up, people who are willing to exploit any tragedy. I think 
the fact that you already have reports of that suggests the VA 
needs to he proactive. 

It seems to me one thing you might want to do with the notifica- 
tion letters is to include a flyer on protecting yourself from identity 
theft. The FTC, for example, has developed some very good mate- 
rials on financial fraud in that area. So that is something that I 
would recommend. 

Mr. Secretary, you mentioned that you are working cooperatively 
with the credit bureaus, which I commend you for. In addition to 
educating veterans that they can receive a free copy of their credit 
report, is the VA looking into other ways to connect veterans with 
their credit reports? 

Secretary NICHOLSON. We are. Senator Collins. We also have 
been looking at some proposals from private sector, proprietary 
companies that are in this business. And our goal would be to see 
if we could create some kind of an overlay over the veteran commu- 
nity that could allay some of their fear and anxiety about this, 
knowing that there is somebody watching it and there is sort of a 
continual alert about them. 

It would work with these three major reporting bureaus. There 
are people in that business and we are looking at it. The cost of 
it is something we are not yet sure of, but I am pretty confident 
that given the volume that we have, that we are dealing with here, 
that we could get a pretty good deal, which would still be a sub- 
stantial amount of money. But I think it is something that our vet- 
erans deserve. 

Chairman CoLLiNS. I agree and I am pleased you are pursuing 
that. 

Mr. Secretary, I want to go back to my initial statement to you 
when I said that I found the chronology that you gave in your testi- 
mony to be baffling. I think you find it to be baffling also. And I 
understand how frustrated and angry you must be that it took 
some 13 days before you were notified of such a serious breach. 

What is your theory on that? How do you think it was possible 
for there to be such long delays in bringing this incident to your 
attention? As I said, it was not minor. It did not involve just a few 
records. It is just so obviously urgent and serious that it is so hard 
for me to understand the failure of those in the Department to in- 
form you. 

Secretary Nicholson. It is an appropriate question. It is difficult 
for me to answer because some of the people along the line are 
some of the most competent, dedicated people I have ever worked 
with anywhere. It is hard to answer, frankly. 

So I am only speculating. We have discussed it. They feel ter- 
rible. They have offered resignations. They were trying to deal with 
it themselves and get their arms around it and handle it. It is not 
clear. 

Chairman COLLINS. Thank you. 

Mr. Chairman. 
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Chairman Craig [presiding]. I have one last question and before 
I do that, if you are leaving us. 

Chairman COLLINS. I do not have anything else. Thank you. 

Chairman Craig. Again, thank you for working with us for this 
joint hearing. I think it is obvious the problem that are now ap- 
pearing in VA, and as we started this hearing, the question re- 
mains are these same problems system wide? The work you are 
doing in your Committee is critical and important. And we will 
monitor this and work with you to make sure that — you never say 
never, but we ought to have systems in place where that argument 
can at least be placed. 

Thank you very much, Susan. 

Chairman COLLINS. Thank you, Mr. Chairman. And again, thank 
you for taking the initiative on this very serious problem. I have 
enjoyed working with you on this hearing. 

Chairman Craig. Thank you very much, Madame Chair. 

Mr. Opfer, the Inspector General Act requires you to keep the 
Secretary and Congress fully and currently informed about any se- 
rious problem regarding VA’s operation. In this case, it appears 
that the Secretary was not notified of the massive data security 
breach until 6 days after the IG Office was alerted to the incident, 
and Members of the Congress were not notified for several days 
after that. 

Again, this question has been asked, but for the record, given the 
magnitude of the data security breach, do you believe the IG’s Of- 
fice acted with sufficient haste in reporting the incident to the Sec- 
retary and ultimately to the Congress? 

Mr. Offer. Yes, I do. Mr. Chairman, let me go through the chro- 
nology again. 

The IG Office was never notified of the security breach. It was 
a normal monthly meeting when an Information Security Officer 
from the IG was attending. It was not talked about. It was men- 
tioned that an employee had some data stolen from a burglary at 
his residence. No information was given to that employee of the 
significance of it. 

He followed up on his own to try to find out what information 
he could. That was on the information of May 10th. There was no 
information given to the IG. 

He wrote it up and gave it to our Office of Investigations that 
went to the Department on Friday, May 12th to try to locate this 
Information Security Officer. The officer was not at work. The 
agents did not just wait. They tried to contact him at home. He 
was on leave. They were not able to contact that Information Secu- 
rity Officer that had the information until Monday the 15th. That 
is when they interviewed him, gave the preliminary information. 
We had no knowledge of anything other than an employee had 
some data stolen from the home, the residence. 

It was not until we interviewed the employee on the 15th that 
we realized that we had a significant problem developing there. 
That interview went for hours upon hours of interviewing the em- 
ployee. That is where the information came to the IG. 

With the story what he was saying he had access to this type of 
information, that first thing you need to do is ask, is it credible? 
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Would an employee have that much access to that type of sensitive 
information? And would he be able to take it to his residence? 

The second part was then to look if there were other issues with 
that employee? The investigators went through the background, 
doing name checks, record checks, reviewing his official personnel 
folder, looking at any issues that we may have had in the IG’s Of- 
fice, trying to determine, contacting their local police. Was there a 
burglary? Was it reported? Was it similar to others? Or was this 
a staged burglary? Were there issues with the employee? His fam- 
ily, with the police? 

It was not until the morning of the 16th of May that they spoke 
to the police. But they had to get to the detective that was doing 
this to see what we had. It was then immediately that the agents 
told the detective of the seriousness of what we were looking at, of 
the possible breach of millions of personal identification informa- 
tion. 

On the 16th, they came to me in the morning to brief me. I im- 
mediately, before he even finished the briefing, got on the phone 
to the Chief of Staff who was with Tim McClain, the Counsel, and 
explained to him what we had. We had a serious problem. The in- 
formation only was coming to us from the interview of the agents 
with the employee. 

On the 16th, in the morning, this was about 9:30, when I spoke 
to the Chief of Staff, he told me that he was aware of an incident 
but did not realize the magnitude of the incident. It was after they 
had the 11 o’clock meeting, that I again spoke to the Chief of Staff 
and told him that I requested that he brief the Secretary on the 
severity of this. 

The Secretary was out of town attending the funeral service of 
former Congressman Sonny Montgomery. The Chief of Staff told 
me the Secretary would be back at 7 o’clock that night and he 
would brief him on it. The next morning, every day from then on, 
I had constant contact. 

So when it came to my attention, the Secretary was notified im- 
mediately from the Chief of Staff on the 16th. 

On the 17th, we again were confirming and working with the 
Montgomery County Police through the 15th, 16th and 17th. On 
the 17th, this is one day now from when we are verifying that we 
had a serious problem which was verified to us on the 16th, not 
only from the employee’s interview, but verified that he did have 
access to this material, we notified the Federal Bureau of Inves- 
tigation both from field office to field office, as well as the Acting 
Assistant Director for Criminal Division. So notifications were 
made in a very serious and coordinated effort. 

I had to balance a decision of whether or not to release that in- 
formation. During all of these periods of conversations that I was 
having with senior level officials within the Department, I was ad- 
vising them of my statutory responsibility both to Congress and 
both to notify the appropriate Federal law enforcement agencies, 
which we did within a day. 

The decision not to go public was one, and I kept using the 
phrase we are on borrowed time. As the IG’s Office was ratcheting 
this up, as we were going out doing interviews, more people were 
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going to become aware of what we are looking at. And I was con- 
cerned it was going to be released. 

Right from the beginning, on the 17th, I had conversations with 
the Chief of Staff that somehow along the line I was going to start 
these notifications. But the Chief of Staff agreed that we needed to 
be proactive and the Department was being proactive to reach out 
to try to look at what lessons they could get from the Federal 
Trade Commission, the Commerce Department, to establish the 
800 number, the Web site and all these initiatives that went in. 

I had to balance where along the line does that come to with 
what we had as investigative leads which were quickly 
evaporating. We were very aggressively investigating every inves- 
tigative lead that we had. And during that whole period of time, 
I was saying I am coming to the point I cannot justify legally or 
morally not making those notifications relative to investigative 
leads because they just were not there as we were knocking them 
off. 

On Thursday evening, I had a conference call with the Secretary, 
the Chief of Staff and the Counsel, and I do not know if anyone 
else was present. We talked about this. I talked about my position 
that we came to the point now, from the Inspector General’s posi- 
tion, we should go public. It was time to make the notifications. 

We talked about do we balance that with the panic that we could 
cause for the veterans? 

I still said this did not outweigh my obligation and I would not 
delay that notification any longer. I felt from an investigative 
standpoint we have gotten to the point we were exhausting all of 
the leads that were available. 

It was agreed that the next morning I would receive a copy of 
a draft statement making the announcement. My staff contacted 
the appropriate Members of the Committee staff. I was prepared 
to make that notification on Friday. 

And I would like to ask Jon Wooditch then to talk about what 
happened Friday afternoon to try to convince us then to hold off. 

Mr. Wooditch. I was contacted by the VA General Counsel, who 
asked us to talk to the Director at the Federal Trade Commission 
because they were not quite ready with the Web sites and the hot 
lines and all of the other tools that they were going to use to satisfy 
the veterans calling in. It seemed to be a legitimate request. If we 
went out prematurely and we were not ready to deal with all of the 
calls that we were going to get, it could cause panic. 

So, I agreed to talk to the FTC Director and she convinced me 
that they would work feverishly over the weekend and have it done 
by Monday. Monday it was completed and the Secretary did, in 
fact, make the announcement on Monday. 

Mr. Offer. I would also add on Sunday, that Sunday, I had two 
telephone conversations with the Associate Attorney General ask- 
ing me if my position was still that. And I said I was concerned 
that we could not wait any longer. And I needed to verify, he was 
going to a meeting at the White House to verify that the FTC and 
all of these operations were going to be in place for Monday. He 
called me back later. He wanted to know, from my perspective as 
lead investigator for the GIG, and we discussed that he would 
reach out to the FBI to see if they had any additional leads. I said 
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I was not aware of any, but I would reach out again to my super- 
visor and the agents working to see if there were any leads left 
that would justify withholding going public at that point. 

So, I do believe it was done in a timely manner. 

Chairman Craig. I mean, I find that fascinating. I am not here 
to challenge your judgment. I think I have, we probably have a bet- 
ter picture of what did and did not happen. 

I would hope that you all collectively look at what you did and 
how you did it with the hindsight you now have. It appears to me 
to be a fascinating case study. I do not know whether I am overre- 
acting or under reacting. I do not know whether you overreacted 
or under reacted as it relates to the knowledge you had and how 
you handled the knowledge. 

I know one thing, that it was not until May 22 that I found out 
about it. And I do not believe I or this Chairman can be called pub- 
lic. We are not the public. 

Mr. Offer. I was not talking about that. I was also talking about 
notifying Congress. It was whether or not, even again on Sunday 
I was requested by the Justice Department if I would reconsider 
my position. 

Chairman Craig. And yet, at the same time, I appreciate having 
the tools in place to handle response to an announcement of this 
magnitude. I can hardly question that because obviously you were 
getting a great concern and there is a lot of — as the information 
flows out, there is a growing concern amongst veterans as to 
whether they, in fact, have been compromised or not. 

That is part of why we are here today. But it is also why we are 
here to review, and in some instances to criticize. 

I hope that both of you recognize the importance of a constructive 
dialogue that gets us, as I said, not ever having this happen again. 
I do not believe in nevers. They just do not exist. But certainly we 
have had a record of problems here, not of this magnitude, and 
clearly one now that I trust will move forward on. 

Certainly this Committee, and I know that Susan’s Committee 
will do the same thing. And as we look beyond VA to other agen- 
cies of Government to make sure that similar protocol and cer- 
tainly similar policy is put in place. And my guess is with the legis- 
lation that is out there, legislation that will become law passed by 
Congress in relatively short order as it relates to these kinds of 
things. 

Susan, do you have any additional things you want to say? 

Chairman COLLINS. No, thank you. 

Chairman Craig. Again, gentlemen, thank you very, very much 
for being here this morning and being as cooperative as you now 
are. We appreciate that a great deal as we work our way through 
this. It is a joint effort. 

And Mr. Secretary, I appreciate your responses and obviously 
taking the responsibility that a person in your position must take 
to deal with these kinds of issues. 

But again, you have a cooperating Committee here that wants to 
make sure we deal with this in the appropriate fashion and, where 
necessary, to provide the resources, if necessary, to make sure that 
this goes away as quickly as possible and that no veteran is in- 
jured. 
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Gentlemen, thank you both. Thank you all very much. 

The Committee record will remain open. Several of my colleagues 
have asked to submit questions in writing and, of course, we will 
allow that to happen. We will keep the record open for at least 2 
weeks. 

Thank you. 

Voice: Will you take a statement from an affected veteran? 

Chairman Craig. I will be happy to visit with you afterwards 
and anything you want to submit to us, we will be happy to put 
in the record. 

Thank you very much. 

The Committee will stand adjourned. 

[Whereupon, at 12:41 p.m., the Committee was adjourned.] 




APPENDIX 


Prepared Statement of Hon. Norm Coleman, U.S. Senator from Minnesota 

We are witnessing a disturbing trend in the Federal Government recently in 
which problems have been identified, warnings and recommendations have lieen 
issued and then no action takes place. The news delivered Tuesday that up to 26.5 
million veterans, the very people we have asked to sacrifice so much for this Nation, 
were now vulnerable to identity theft because a VA employee was able to just walk 
out of the building with highly sensitive information is appalling. 

Equally outrageous is that after a third-rate burglary took place and put veterans 
at risk on May 3rd , we learned yesterday that Secretary Nicholson was not notified 
of the breach for 13 days, and the FBI was not notified for 14 days. And if that 
weren’t enough, since 2001 the VA Inspector General has reported security 
vulnerabilities relating to the operating system, passwords, a lack of strong detec- 
tion alerts, and the need for better access controls. 

Mr. Secretary, while it was unfortunate you were not informed earlier of the bur- 
glary, identity theft is not a new problem and the blunt assessment the VA was 
given from its Inspector General should have immediately been addressed. It is also 
unfortunate and troubling that while the VA employee who was robbed informed the 
VA of what happened that same day, it took the VA 19 days, almost 3 weeks, to 
inform Veterans that they may be at-risk to identity theft. 

Additionally, identity theft and fraud is a national problem that has affected more 
than 10 million Americans and this case raises the question of what the Federal 
Government is doing to protect all sensitive information so it does not fall into the 
wrong hands. The Federal Government is responsible for maintaining and pro- 
tecting sensitive information that Americans are required to provide for a wide 
array of reasons, including paying teixes, receiving medical and disability benefits, 
and obtaining retirement compensation. 

In order to determine the extent of the vulnerabilities in information security 
across the Federal Government, yesterday I sent a letter to the Government Ac- 
countability Office requesting a governmentwide review of the current policies and 
practices in place meant to protect the sensitive identity information of Americans, 
and whether these policies may allow for a similar type of security breach at other 
Federal agencies. 

The bottom line is that American citizens deserve to know if their sensitive infor- 
mation is safe. 


Prepared Statement of the Center for Democracy and Technology 

The Center for Democracy and Technology is deeply troubled by the revelation 
that the Department of Veterans Affairs carelessly allowed the personal data of mil- 
lions of men and women who’ve served this country to fall into the hands of a sim- 
ple burglar. Yet, it is our view that this breach is not the failure of one employee 
or even one agency. It is symptomatic of a larger failure of data management across 
the Federal Government. 

Until we bring the aging laws and policies that protect our personal information 
up to date with modern technology, these catastrophic data “spills” will only get 
worse. 

Attorney General Alberto Gonzalez responded to the breach — the latest in a series 
of private and public sector privacy gaffes — by vowing to closely monitor for any 
signs of identity theft and to aggressively pursue offenders. This is an appropriate 
and necessary response, now that the data has been compromised, but it doesn’t 
come close to providing the comprehensive protection for personal information ex- 
pected when the Privacy Act was passed in 1974. 

( 51 ) 
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A growing body of research, supported by years of Government Accountability Of- 
fice reports, makes clear that it is time to bolster the protections in that law and 
dramatically improve enforcement. 

In 2003, GAO made clear that “the government cannot adequately assure the pub- 
lic that all legislated individual privacy rights are being protected.” This report and 
others made clear that the problem is not with an individual agency but rather an 
endemic lack of leadership from the White House and its Office of Management and 
Budget over Privacy Act enforcement. In the absence of strong Administration lead- 
ership individual agencies have been left to fend for themselves in bringing their 
information practices in line with the Privacy Act. 

CDT’s discussions with agency privacy officers support the GAO findings. One 
chief privacy officer for a key agency told us that half of the agency’s Privacy Act 
systems of records — the databases most likely to have sensitive information on 
Americans — were simply missing. 

To address these serious concerns, GAO correctly recommends that agencies be 
given better guidance and follow best practices. The Office of Management and 
Budget’s Privacy Act guidance was written in 1976 and has never been comprehen- 
sively updated. Technology has evolved enough in the past 3 years, let alone the 
past 30, to warrant a thorough rewrite of that guidance. Such a rewrite alone would 
send a clear message to agency heads and privacy officers that they will be held 
responsible for the sensitive data in their care. 

Although renewed leadership on Privacy Act compliance would be an important 
first step, it’s also the case that the law itself is in need of renovation, given the 
technological revolution that has taken place in the decades since its passage. Con- 
gress must patch the holes in the aging laws intended to protect the personal infor- 
mation that Americans entrust to the government before more massive data 
breaches occur. 

Because of the rash of high-profile data breaches in the private sector. Congress 
has focused its legislative efforts on establishing data breach rules for the private 
sector and has not given the same attention to the serious privacy and security 
problems in government agencies that collect and maintain databases of personal 
data on Americans. Indeed, only one of the data-breach bills under consideration 
even begins to address the Federal Government’s use of personal information. The 
measure, S. 1789, The Personal Data Privacy and Security Act” sponsored by Sen- 
ators Arlen Specter (R-Pa.) and Patrick Leahy (D-Vt.) would, among other things, 
require greater oversight over the government’s use of personal data and would 
limit the government’s ability to augment its data with additional information pur- 
chased from private-sector companies like ChoicePoint. Today, many government 
agencies are using this commercial data in ways that violate the spirit of the Pri- 
vacy Act, but not the letter of the law. These practices have encouraged an atmos- 
phere that suggests that the law is not as relevant as it was at the time that it 
was passed. 

Enacting those provisions would be a valuable step toward safeguarding our per- 
sonal data, but Congress should go further and enact comprehensive legislation to 
bring Privacy Act into the 21st century. The law, written during the age of the 
mainframe computer, must be updated to respond to new technologies. Today, a 
smart phone can hold as much data as computers that occupied an entire room in 
1974. Congress can start by updating the basic definitions of the Act and limiting 
the routine exemptions on the data. 

As early as 1977, a Congressional commission found that the Act’s central defini- 
tion — “systems of records” — was already outdated. Particularly on the Internet, 
where multiple databases can be linked, searched, copied and reconfigured, the con- 
cept simply does not work. Moreover, privacy advocates and policymakers have long 
complained that the “routine use” exemption is being used in ways going far beyond 
its original intent. That definition also needs to be reconsidered. 

Congress may also want to review the effectiveness and applicability of sections 
of the Teixpayer Browsing Protection Act of 1997, which was passed after abuses by 
IRS employees, including improper removal of taxpayer records from the agency, 
were revealed. 

Americans entrust the Federal Government with significant amounts of our per- 
sonal information in order to deliver benefits and services. Updating privacy over- 
sight, policy and law in this area is the first necessary step to ensuring that this 
information is not simply left vulnerable to common thieves. 
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Prepared Statement of the Department of Veterans Affairs 

The Department of Veterans Affairs (VA) has recently learned that an employee, 
a data analyst, took home electronic data from VA, which he was not authorized 
to do. This behavior was in violation of our policies. This data contained identifying 
information including names, social security numbers, and dates of birth for up to 
26.5 million veterans and some spouses, as well as some disability ratings. Impor- 
tantly, the affected data did not include any of VA’s electronic health records nor 
any financial information. The employee’s home was burglarized and this data was 
stolen. The employee has been placed on administrative leave pending the outcome 
of an investigation. 

Appropriate law enforcement agencies, including the FBI and the VA Inspector 
General’s office, have launched full-scale investigations into this matter. Authorities 
believe it is unlikely the perpetrators targeted the items because of any knowledge 
of the data contents. It is possible that they remain unaware of the information 
which they possess or of how to make use of it. However, out of an abundance of 
caution, VA is taking all possible steps to protect and inform our veterans. 

VA is working with Members of Congress, the news media, veterans service orga- 
nizations, and other government agencies to help ensure that those veterans and 
their families are aware of the situation and of the steps they may take to protect 
themselves from misuse of their personal information. VA will send out individual 
notification letters to veterans to every extent possible. Veterans can also go to 
www.firstgov.gov to get more information on this matter. This website is being set 
to handle increased web traffic. Additionally, working with other government agen- 
cies, VA has set up a manned call center that veterans may call to get information 
about this situation and learn more about consumer identity protections. That toll 
free number is 1-800-FED INFO (333—4636). The call center will be open beginning 
today, and will operate from 8 a.m. to 9 p.m. (EDT), Monday-Saturday as long as 
it is needed. The call center will be able to handle up to 20,000 calls per hour 
(260,000 calls per day). 

Secretary of Veterans Affairs R. James Nicholson has briefed the Attorney Gen- 
eral and the Chairman of the Eederal Trade Commission, co-chairs of the Presi- 
dent’s Identity Theft Task Eorce. Task Force members have already taken actions 
to protect the affected veterans, including working with the credit bureaus to help 
ensure that veterans receive the free credit report they are entitled to under the 
law. Additionally, the Task Force will meet today to coordinate the comprehensive 
Federal response, recommend further ways to protect affected veterans, and in- 
crease safeguards to prevent the reoccurrence of such incidents. VA’s mission to 
serve and honor our Nation’s veterans is one we take very seriously and the 235,000 
VA employees are deeply saddened by any concern or anxiety this incident may 
cause our veterans and their families. We appreciate the service our veterans have 
given their country and we are working diligently to protect them from any harm 
as a result of this incident. 


VA’s Notification to Veterans 

Dear Veteran: The Department of Veterans Affairs (VA) has recently learned that 
an employee took home electronic data from VA, which he was not authorized to 
do and was in violation of established policies. The employee’s home was burglarized 
and this data was stolen. The data contained identifying information including 
names, social security numbers, and dates of birth for up to 26.5 million veterans 
and some spouses, as well as some disability ratings. As a result of this incident, 
information identifiable with you was potentially exposed to others. It is important 
to note that the affected data did not include any of VA’s electronic health records 
or any financial information. 

Appropriate law enforcement agencies, including the FBI and the VA Inspector 
General’s office, have launched full-scale investigations into this matter. Authorities 
believe it is unlikely the perpetrators targeted the items because of any knowledge 
of the data contents. It is possible that they remain unaware of the information 
which they possess or of how to make use of it. 

Out of an abundance of caution, however, VA is taking all possible steps to protect 
and inform our veterans. While you do not need to take any action unless you are 
aware of suspicious activity regarding your personal information, there are many 
steps you may take to protect against possible identity theft and we wanted you to 
be aware of these. Specific information is included in the attached question and an- 
swer sheet. For additional information, VA has teamed up the Federal Trade Com- 
mission and has a website {www.firstgov.gov) with information on this matter or you 
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may call 1-800-FED-INFO (1-800-333-4636). The call center will operate from 8 
a.m. to 9 p.m. (EDT), Monday-Saturday, as long as it is needed. 

We apologize for any inconvenience or concern this situation may cause, but we 
at VA believe it is important for you to be fully informed of any potential risk result- 
ing from this incident. Again, we want to reassure you we have no evidence that 
your protected data has been misused. We will keep you apprised of any further de- 
velopments. The men and women of VA take our obligation to honor and serve 
America’s veterans very seriously and we are committed to seeing this never hap- 
pens again. Sincerely, R. James Nicholson Secretary of Veterans Affairs. 

Sincerely, 

R. James Nicholson, 
Secretary of Veterans Affairs. 


Foe Immediate Release 

May 22, 2006 

fkequently asked questions on va’s lettee to veterans 

Question 1. I’m a veteran, how can I tell if my information was compromised? 

Response. At this point there is no evidence that any missing data has been used 
illegally. However, the Department of Veterans Affairs is asking all veterans to be 
extra vigilant and to carefully monitor bank statements, credit card statements and 
any statements relating to recent financial transactions. If you notice unusual or 
suspicious activity, you should report it immediately to the financial institution in- 
volved and contact the Federal Trade Commission for further guidance. 

Question 2. What is the earliest date at which suspicious activity might have oc- 
curred due to this data breach? 

Response. The information was stolen from an employee of the Department of 
Veterans Affairs during the month of May, 2006. If the data has been misused or 
otherwise used to commit fraud or identity theft crimes, it is likely that veterans 
may notice suspicious activity during the month of May. 

Question 3. I haven’t noticed any suspicious activity in my financial statements, 
but what can I do to protect myself and prevent being victimized by credit card 
fraud or identity theft? 

Response. The Department of Veterans Affairs strongly recommends that veterans 
closely monitor their financial statements and visit the Department of Veterans Af- 
fairs special website on this, www.firstgov.gov or call 1-800-FED-INFO (1-800- 
333^636). 

Question 4. Should I reach out to my financial institutions or will the Department 
of Veterans Affairs do this for me? 

Response. The Department of Veterans Affairs does not believe that it is nec- 
essary to contact financial institutions or cancel credit cards and bank accounts, un- 
less you detect suspicious activity. 

Question 5. Where should I report suspicious or unusual activity? 

Response. The Federal Trade Commission recommends the following four steps if 
you detect suspicious activity: 

Step 1. — Contact the fraud department of one of the three major credit bureaus: 
Equifax: 1-800-625-6285, www.equifax.com, P.O. Box 740241, Atlanta, GA 30374- 
0241; Experian: 1-888-EXPERIAN (397-3742) www.experian.com, P.C). Box 9532, 
Allen, Texas 75013; TransUnion: 1-800-680-7289, www.transunion.com. Fraud Vic- 
tim Assistance Division, P.O. Box 6790, Fullerton, CA 92834-6790. 

Step 2. — Close any accounts that have been tampered with or opened fraudu- 
lently. 

Step 3. — File a police report with your local police or the police in the community 
where the identity theft took place. 

Step 4. — File a complaint with the Federal Trade Commission by using the FTC’s 
Identity Theft Hotline by telephone: 1-877^38-4338, online at www.consumer.gov / 
idtheft, or by mail at Identity Theft Clearinghouse, Federal Trade Commission, 600 
Pennsylvania Avenue, NW., Washington DC 20580. 

Question 6. I know the Department of Veterans Affairs maintains my health 
records electronically; was this information also compromised? 

Response. No electronic medical records were compromised. The data lost is pri- 
marily limited to an individual’s name, date of birth, social security number, in 
some cases their spouse’s information, as well as some disability ratings. However, 
this information could still be of potential use to identity thieves and we recommend 
that all veterans be extra vigilant in monitoring for signs of potential identity theft 
or misuse of this information. 
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Question 7. What is the Department of Veterans Affairs doing to insure that this 
does not happen again? 

Response. The Department of Veterans Affairs is working with the President’s 
Identity Theft Task Force, the Department of Justice and the Federal Trade Com- 
mission to investigate this data breach and to develop safeguards against similar 
incidents. The Department of Veterans Affairs has directed all VA employees com- 
plete the “VA Cyber Security Awareness Training Course” and complete the sepa- 
rate “General Employee Privacy Awareness Course” by June 30, 2006. In addition, 
the Department of Veterans Affairs will immediately be conducting an inventory 
and review of all current positions requiring access to sensitive VA data and require 
all employees requiring access to sensitive VA data to undergo an updated National 
Agency Check and Inquiries (NACI) and/or a Minimum Background Investigation 
(MBI) depending on tbe level of access required by the responsibilities associated 
with their position. Appropriate law enforcement agencies, including the Federal 
Bureau of Investigation and the Inspector General of the Department of Veterans 
Affairs, have launched full-scale investigations into this matter. 

Question 8. Where can I get further, up-to-date information? 

Response. The Department of Veterans Affairs has set up a special website and 
a toll-free telephone number for veterans which features up-to-date news and infor- 
mation. Please visit www.firstgov.gov or call 1-800-FED-INFO (333-4636). 

(a) CDT is a non-profit, public interest organization dedicated to preserving and 
promoting privacy, civil liberties and other democratic values on the Internet and 
new communications technology. Since its founding in 1994, CDT has tracked gov- 
ernment information technology privacy and security policy to ensure that it has 
been kept up to date. This has included reports and testimony on the Privacy Act, 
the privacy provisions of the E-Government Act and the Federal Information Secu- 
rity Management Act. 

(b) GAO, Privacy Act: 0MB Leadership Needed to Improve Agency Compliance, 
GAO-03-304 (Washington, DC; June 30, 2003). 

(c) CDT has championed the return of the Chief Privacy Counselor, or similar po- 
sition, to 0MB. At the end of the Clinton Administration, Chief Privacy Counselor 
Peter Swire produced regular guidance to agencies that, while not comprehensive, 
at least moved many agencies toward positive progress on important privacy mat- 
ters. 

(d) 0MB, “Privacy Act Implementation: Guidelines and Responsibilities,” Federal 
Register, Volume 40, Number 132, Part III, pp. 28948-28978 (Washin^on, DC.: 
July 9, 1976). There has been irregular guidance such as that issued on May 22, 
2006 (the day of the public announcement of the breach). 

(e) Privacy Protection Study Commission, Personal Privacy in an Information So- 
ciety, July 1977. An electronic version is available at http: ! 1 www.epic.org ! privacy ! 
ppscl977report I fPL 105-35. 
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